I've set gpgcheck=1 to install trivy, and failed with:

Package trivy-0.16.0.el8.x86_64.rpm is not signed

I'll not let unsigned repositories on my OS, sorry. As a security company you should know why that's important. Please fix this.