I usually self-host and re-sign RPMs. Only allow items that are signed by one of my trusted keys to install.