On 2), noone caught this before because Rawhide packages are unsigned making PackageKit prompt for password and also because those of who choose to retain the authorization while entering the password for the first time wouldn't notice the difference after an upgrade. So it's not the fault of the lifecycle. Maintainers are certainly responsible for announcing and documenting the changes properly.