We've been signing RPM's since https://jira.mongodb.org/browse/SERVER-8770 - in 3.0.8+ so we should change the rpm installation docs for redhat, suse, amazon linux, for both community and enterprise, to include gpgcheck=1 and include instructions for importing our public keys.

For example here we imply our packages aren't signed and don't mention verification or importing the public key -
https://docs.mongodb.org/manual/tutorial/install-mongodb-on-amazon/

And here we mention it -
https://docs.mongodb.org/manual/tutorial/install-mongodb-on-ubuntu/#import-the-public-key-used-by-the-package-management-system