Update to nss-softokn 3.14.3-19 breaks RPM

Issue

• bad signature errors when running rpm commands:

  # rpm -qa 
  error: rpmdbNextIterator: skipping h#     496 Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD
  error: rpmdbNextIterator: skipping h#     241 Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD
  error: rpmdbNextIterator: skipping h#     498 Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD
  error: rpmdbNextIterator: skipping h#     243 Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD
  error: rpmdbNextIterator: skipping h#     500 Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD
  ...
  

• "Problem with the SSL CA cert" errors when download rpm files in yum:

  # yum update -y
  [...]
    system-config-firewall-base-1.2.27-7.2.el6_6.noarch: failed to retrieve getPackage/system-config-firewall-base-1.2.27-7.2.el6_6.noarch.rpm from rhel-x86_64-server-6
  error was [Errno 14] PYCURL ERROR 77 - "Problem with the SSL CA cert (path? access rights?)"
  

• rpm query commands don't show any packages installed, or only show gpg-pubkey packages as follows:

  # rpm -q kernel
  error: rpmdbNextIterator: skipping h#     206 Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD
  package kernel is not installed
  # rpm -qa 2>/dev/null
  gpg-pubkey-2fa658e0-45700c69
  gpg-pubkey-fd431d51-4ae0493b
  #