To sign an rpm from koji, you should make a copy of the file, sign
it
with the appropriate rpm command, and import the signature. Fedora
rel-eng has a script to help automate this. Note that you should not
simply sign the file directly under /mnt/koji, as this causes an
inconsistency between the filesystem and the database (hence the copy
step).
https://fedorahosted.org/rel-eng/browser/scripts/sign_unsigned.py