Per Google’s feedback “The standard order” for CachyOS or any Arch-based system is: Initialize: sudo pacman-key --init (This sets up the GPG environment if it’s broken or missing.) Populate: sudo pacman-key --populate archlinux cachyos (2) (This imports the trusted keys into your system.) Update Keyrings: sudo pacman -Sy archlinux-keyring cachyos-keyring (3) (This ensures you actually have the newest versions of those keys.) Final Sync: sudo pacman -Syu (This applies the updates to the rest of your system now that the signatures are verified.) “Why the order sometimes swaps” The "Chicken and Egg" Problem: If your system's local archlinux-keyring is too old, it won't recognize the signatures on any new packages you try to download. If you try to populate (Command 2) using an old keyring, it may not have the new master keys needed for current packages. In this case, you must force-update the keyring package first (Command 3) so that the local database has the new keys to "populate" from. Cosmic vs. KDE: Cosmic is a newer, more "experimental" DE in the CachyOS ecosystem. If you were pulling Cosmic packages from a very recent repository update, your system was more likely to demand the absolute latest keys immediately to verify those specific files. Mirror Sync: Sometimes a mirror is slightly out of sync. Updating the keyring package first (3) manually pulls the latest security certificates from the server, which can "unstick" a populate command (2) that was failing because it was looking for keys that didn't exist in your old local files yet. However, the first (e.g. standard) sequence of commands worked for me in case of Cosmic DE setup on Arch Linux.