I was not able to yum update web1 today because it would get stuck on one package:

Package gandi-hosting-vm2-2.34-1.noarch.rpm is not signed

I then learned I could bypass this by adding the clause: --nogpgcheck to the command:

yum update --nogpgcheck gandi-hosting-vm2

This way that package alone got updated, which meant I could go ahead and launch the full yum update again without failures.