From whiteboxlinux.org:

A large batch of errata packages (the bulk of Update2) were posted without GPG signatures. Some have been mirrored out to the mirror sites already. The problem has just been fixed and corrected packages will sync out very soon. There is nothing known to be wrong with the unsigned packages other than my forgetting to sign them but if you are the cautious type you should hold off on running up2date for a day or so.