i'm doing such oneliner (don't ask why) to sign packages caming from stdin:

xargs -l1 -I '%{F}' rpm --nodigest --nosignature -qp --qf '%|SIGGPG?{}:{%{F}\n}|' '%{F}' | xargs -r rpm --resign

it would minimize rpm invocations if rpm supported %{FILENAME} tag expansion:

xargs rpm --nodigest --nosignature -qp --qf '%|SIGGPG?{}:{%{FILENAME}\n}|' | xargs -r rpm --resign

this will output all filenames that do not have %{SIGGPG} tag present.

-- 
glen