You shouldn't tag things directly into those tags, because if you do they will not be signed.
Instead tag into the -candidate tag.
It will be signed, then moved to the -stg version of the tag.
Once it's been tested in stg, only then should you move it to the main tag.

That said, infra should have perm to move to those tags after staging testing is done. I have added that to those tags.

So again, the workflow should be:

• Tag into the -candidate flag (this will be done automatically if you do koji build for the main tag)
• Package will be signed and moved to the stg tag.
• Test in stg
• Move to main tag.

Hope that all makes sense.

That's exactly what I am doing. However I cannot move build to main tag (last step) as it requires autosign (or admin) permission:

ks.tagBuild('f26-infra', 'koschei-2.0.2-1.fc26', fromtag='f26-infra-stg')

Results in:

Fault: <Fault 1004: 'tag requires autosign permission'>

When did you try? because as I said: "That said, infra should have perm to move to those tags after staging testing is done. I have added that to those tags. "

Sorry, I read this as "notabug" with explanation what I should do. It is fixed indeed, thank you.