Package signature bug?

[Neilen Marais]

Hi!

I have some unofficial apt sources that aren't signed. This seems to
confuse apt-get into thinking that none of my packages are signed. For
example, I do a apt-get upgrade to get security updates. Then I get a
message like:

WARNING: The following packages cannot be authenticated!
  binutils gdb kdelibs-data kdelibs4 kdelibs-bin
mozilla-firefox-gnome-support
  mozilla-firefox
Install these packages without verification [y/N]? n
E: Some packages could not be authenticated


However, if I comment out the unofficial source (in this case 
#deb http://download.gna.org/xtla-el/apt/ unstable/) I can do the same
updgrade, with the same packages being installed, without the
authentication verfication warning.

Is this a bug, or some weird misconfiguration?

Thanks
Neilen