Actually, in case of cssu-thumb, it's also matter of merlin's repos being not signed "officially" by certificate acceptable by N900, usually (haven't checked attached logs).

This can be fixed, by adding it to trusted zone manually - command somewhere in this thread.