yes, Mike accurately identified the problem. I did not realize that symlink referred to R14.0.x repository, and that after exclude R14.0.x will be invalid on mirrors. I changed symlink to refer to R14.1.x repository.
would be even better if the keyring package was not bound to a specific branch but just general, IMO. Cheers Michele