pkg: explain PUBKEY

[Anton Shterenlikht]

I'm trying to set up poudriere to build packages
for my boxes. I think I got this done. I have built
a few packages, I set up nginx to serve those.
On the box where I want to install the packages to
I've set PACKAGESITE in /usr/local/etc/pkg.conf
to point to the server with the packages.
However, I get:

# pkg update
Updating repository catalogue
digests.txz                                                   100% 9172     9.0KB/s   9.0KB/s   00:00    
pkg: No signature found in the repository.  Can not validate against /etc/ssl/pkg.conf key.
pkg: No digest falling back on legacy catalog format
repo.txz                                                      100%   91KB  91.3KB/s  91.3KB/s   00:00    
pkg: No signature found in the repository.  Can not validate against /etc/ssl/pkg.conf key.
# pkg upgrade
Updating repository catalogue
digests.txz                                                   100% 9172     9.0KB/s   9.0KB/s   00:00    
pkg: No signature found in the repository.  Can not validate against /etc/ssl/pkg.conf key.
pkg: No digest falling back on legacy catalog format
repo.txz                                                      100%   91KB  91.3KB/s  91.3KB/s   00:00    
pkg: No signature found in the repository.  Can not validate against /etc/ssl/pkg.conf key.
# 

I haven't got /etc/ssl/pkg.conf
The pkg.conf(5) man page only
says:

     PUBKEY: string              Specifies the location to the public RSA key
                                 used for signing the repository database.
                                 The default value for this file is
                                 /etc/ssl/pkg.conf

I'm not clear which side creates this file:
the server which builds the packages?
Or the client that gets the packages
from the server? Or something else
altogether?

Thanks

Anton