diff --git a/lib/package.cc b/lib/package.cc
index 73e9f60505..83de81a93c 100644
--- a/lib/package.cc
+++ b/lib/package.cc
@@ -18,6 +18,7 @@
 
 #include "rpmlead.hh"
 #include "rpmio_internal.hh"	/* fd digest bits */
+#include "rpmlog_internal.hh"	/* rpmlogOnce */
 #include "header_internal.hh"	/* XXX headerCheck */
 #include "rpmvs.hh"
 
@@ -31,6 +32,7 @@ struct pkgdata_s {
     hdrvsmsg msgfunc;
     const char *fn;
     char *msg;
+    uint64_t logDomain;
     rpmRC rc;
 };
 
@@ -110,28 +112,6 @@ rpmTagVal headerMergeLegacySigs(Header h, Header sigh, char **msg)
     return xl->stag;
 }
 
-/**
- * Remember current key id.
- * XXX: This s*** needs to die. Hook it into keyring or sumthin...
- * @param keyid		signature keyid
- * @return		0 if new keyid, otherwise 1
- */
-static int stashKeyid(const char *keyid)
-{
-    static std::mutex keyid_mutex;
-    static std::set<std::string> keyids;
-    int seen = 0;
-
-    if (keyid == NULL)
-	return 0;
-
-    std::lock_guard<std::mutex> lock(keyid_mutex);
-    auto ret = keyids.insert(keyid);
-    seen = (ret.second == false);
-
-    return seen;
-}
-
 static int handleHdrVS(struct rpmsinfo_s *sinfo, void *cbdata)
 {
     struct pkgdata_s *pkgdata = (struct pkgdata_s *)cbdata;
@@ -170,6 +150,7 @@ rpmRC headerCheck(rpmts ts, const void * uh, size_t uc, char ** msg)
 	.msgfunc = appendhdrmsg,
 	.fn = NULL,
 	.msg = NULL,
+	.logDomain = (uint64_t) ts,
 	.rc = RPMRC_OK,
     };
 
@@ -294,8 +275,8 @@ static void loghdrmsg(struct rpmsinfo_s *sinfo, struct pkgdata_s *pkgdata,
     case RPMRC_NOTTRUSTED:	/* Signature is OK, but key is not trusted. */
     case RPMRC_NOKEY:		/* Public key is unavailable. */
 	/* XXX Print NOKEY/NOTTRUSTED warning only once. */
-	if (stashKeyid(sinfo->keyid) == 0)
-	    lvl = RPMLOG_WARNING;
+	if (rpmlogOnce(pkgdata->logDomain, sinfo->keyid, RPMLOG_WARNING, "%s: %s\n", pkgdata->fn, msg))
+	    goto exit;
 	break;
     case RPMRC_NOTFOUND:	/* Signature/digest not present. */
 	lvl = RPMLOG_WARNING;
@@ -307,6 +288,8 @@ static void loghdrmsg(struct rpmsinfo_s *sinfo, struct pkgdata_s *pkgdata,
     }
 
     rpmlog(lvl, "%s: %s\n", pkgdata->fn, msg);
+ exit:
+    ;
 }
 
 rpmRC rpmReadPackageFile(rpmts ts, FD_t fd, const char * fn, Header * hdrp)
@@ -323,6 +306,7 @@ rpmRC rpmReadPackageFile(rpmts ts, FD_t fd, const char * fn, Header * hdrp)
 	.msgfunc = loghdrmsg,
 	.fn = fn ? fn : Fdescr(fd),
 	.msg = NULL,
+	.logDomain = (uint64_t) ts,
 	.rc = RPMRC_OK,
     };
 
diff --git a/lib/rpmts.cc b/lib/rpmts.cc
index cb894af532..758b893354 100644
--- a/lib/rpmts.cc
+++ b/lib/rpmts.cc
@@ -30,6 +30,7 @@
 #include "rpmplugins.hh"
 #include "rpmts_internal.hh"
 #include "rpmte_internal.hh"
+#include "rpmlog_internal.hh"
 #include "misc.hh"
 #include "rpmtriggers.hh"
 
@@ -575,6 +576,7 @@ rpmts rpmtsFree(rpmts ts)
     ts->plugins = rpmpluginsFree(ts->plugins);
 
     rpmtriggersFree(ts->trigs2run);
+    rpmlogReset((uint64_t) ts);
 
     if (_rpmts_stats)
 	rpmtsPrintStats(ts);
diff --git a/tests/rpmpython.at b/tests/rpmpython.at
index 381f86ff2b..506a94eaf7 100644
--- a/tests/rpmpython.at
+++ b/tests/rpmpython.at
@@ -353,6 +353,24 @@ for e in ts:
 lock]
 )
 
+RPMPY_TEST([log suppression per transaction],[
+for i in range(4):
+    try:
+        ts.addInstall('${RPMDATA}/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm', 'u')
+    except rpm.error as e:
+        print(e)
+    if i==1:
+        ts = rpm.ts()
+],
+[public key not available
+public key not available
+public key not available
+public key not available
+],
+[warning: /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm: Header V4 RSA/SHA512 Signature, key ID 1f71177215217ee0: NOKEY
+warning: /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm: Header V4 RSA/SHA512 Signature, key ID 1f71177215217ee0: NOKEY]
+)
+
 RPMPY_TEST([transaction callback 1],[
 def ocb(what, amount, total, key, data):
     print(what, amount, total, type(key), data)