The old process flow when a new upstream release came out was:

• edit tarball version numbers in filenames inside 'upstream' file

• run 'make new-base' to download the new source tarballs, check their upstream signatures against the upstream key & upload them to the fedora lookaside cache

• run 'cvs rm -f' to remove the .asc file for the old tarball

Even better, the 'fedpkg' version could do away with the 'upstream' file and make use of the SourceN: lines in the spec file instead. Where these use %{version}, the packager just has to edit the 'Version:' line (which they have to do anyway) before running 'fedpkg new-base' to get, verify and upload the new source.