diff --git a/lib/keystore.cc b/lib/keystore.cc
index a64ef07d6a..382a028e83 100644
--- a/lib/keystore.cc
+++ b/lib/keystore.cc
@@ -247,11 +247,17 @@ rpmRC keystore_rpmdb::load_keys(rpmtxn txn, rpmKeyring keyring)
     while ((h = rpmdbNextIterator(mi)) != NULL) {
 	struct rpmtd_s pubkeys;
 	const char *key;
+	char *nevr = headerGetAsString(h, RPMTAG_NEVR);
 
-	if (!headerGet(h, RPMTAG_PUBKEYS, &pubkeys, HEADERGET_MINMEM))
-	   continue;
+	/* don't allow normal packages named gpg-pubkey */
+	if (headerIsEntry(h, RPMTAG_ARCH) || headerIsEntry(h, RPMTAG_OS) ||
+	    !headerGet(h, RPMTAG_PUBKEYS, &pubkeys, HEADERGET_MINMEM))
+	{
+	    rpmlog(RPMLOG_WARNING, _("%s is not a valid public key\n"), nevr);
+	    free(nevr);
+	    continue;
+	}
 
-	char *nevr = headerGetAsString(h, RPMTAG_NEVR);
 	while ((key = rpmtdNextString(&pubkeys))) {
 	    uint8_t *pkt;
 	    size_t pktlen;
diff --git a/lib/rpmte.cc b/lib/rpmte.cc
index 6b98918752..f923e12845 100644
--- a/lib/rpmte.cc
+++ b/lib/rpmte.cc
@@ -159,9 +159,18 @@ static int addTE(rpmte p, Header h, fnpyKey key, rpmRelocation * relocs)
     p->arch = headerGetAsString(h, RPMTAG_ARCH);
     p->os = headerGetAsString(h, RPMTAG_OS);
 
-    /* gpg-pubkey's dont have os or arch (sigh), for others they are required */
-    if (!rstreq(p->name, "gpg-pubkey") && (p->arch == NULL || p->os == NULL))
+    if (p->arch == NULL || p->os == NULL) {
+	if (p->type == TR_REMOVED && rstreq(p->name, "gpg-pubkey")) {
+	    rpmlog(RPMLOG_WARNING, _("erasing gpg-pubkey packages is deprecated; use rpmkeys --delete %s\n"), p->version);
+	} else {
+	    goto exit;
+	}
+    }
+
+    if (p->type != TR_REMOVED && rstreq(p->name, "gpg-pubkey")) {
+	rpmlog(RPMLOG_ERR, _("public keys can not be installed as gpg-pubkey packages; use rpmkeys --import <keyfile> for that\n"));
 	goto exit;
+    }
 
     p->isSource = headerIsSource(h);
     
diff --git a/tests/rpmpython.at b/tests/rpmpython.at
index 0fb516e3bf..a9dc8e3177 100644
--- a/tests/rpmpython.at
+++ b/tests/rpmpython.at
@@ -340,6 +340,43 @@ for e in ts:
 [adding upgrade to transaction failed]
 )
 
+RPMPY_TEST([add bogus package to transaction 3],[
+
+for tag in ["os", "arch", "name", "version", "release"]:
+    h = ts.hdrFromFdno('${RPMDATA}/RPMS/hello-1.0-1.ppc64.rpm')
+    del h[tag]
+    try:
+        ts.addInstall(h, 'foo', 'u')
+    except rpm.error as err:
+        myprint(err)
+for e in ts:
+    myprint(e.NEVRA())
+],
+[adding upgrade to transaction failed
+adding upgrade to transaction failed
+adding upgrade to transaction failed
+adding upgrade to transaction failed
+adding upgrade to transaction failed
+],
+[])
+
+RPMPY_TEST([add bogus package to transaction 4],[
+
+h = ts.hdrFromFdno('${RPMDATA}/RPMS/hello-1.0-1.ppc64.rpm')
+del h["name"]
+h["name"] = "gpg-pubkey"
+try:
+    ts.addInstall(h, 'foo', 'u')
+except rpm.error as err:
+    myprint(err)
+for e in ts:
+    myprint(e.NEVRA())
+],
+[adding upgrade to transaction failed
+],
+[error: public keys can not be installed as gpg-pubkey packages; use rpmkeys --import <keyfile> for that
+])
+
 RPMPY_TEST([transaction element userdata],[
 mydata = { 'foo': 'bar', 'capstest': 'lock' }
 ts.addInstall('${RPMDATA}/RPMS/foo-1.0-1.noarch.rpm', 'u')
diff --git a/tests/rpmsigdig.at b/tests/rpmsigdig.at
index 0b92c929d1..38885eb5da 100644
--- a/tests/rpmsigdig.at
+++ b/tests/rpmsigdig.at
@@ -122,6 +122,16 @@ runroot rpmkeys --list
 [0],
 [],
 [])
+
+runroot rpmkeys --import /data/keys/rpm.org-rsa-2048-test.pub
+RPMTEST_CHECK([
+runroot rpm -e gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc
+runroot rpm -qa gpg-pubkey
+],
+[0],
+[],
+[warning: erasing gpg-pubkey packages is deprecated; use rpmkeys --delete 771b18d3d7baa28734333c424344591e1964c5fc
+])
 RPMTEST_CLEANUP
 
 AT_SETUP([rpmkeys migrate from keyid to fingerprint (rpmdb)])