All templates are signed with my Qubes OS Signing key:
pub 4096R/C8C0C2EF 2016-06-25
Key fingerprint = 4B1F 400D F256 51B5 3C41 41B3 8B3F 30F9 C8C0 C2EF
uid unman (Qubes OS signing key)
sub 4096R/4731B36C 2016-06-27 [expires: 2022-06-30]
You'll need to get this from a keyserver, or two, to make sure all is fine.
You can also check the Qubes users mailing list or github.
You can check the signature, after importing my public key, by, (e.g):
'rpm -K template_package_name'
Templates like Parrot or Kali are based on Debian testing.
To avoid breakage when updating the core Qubes packages are on hold.
This means that they will not be updated.
You can check this by 'apt-mark showhold'.
'apt-mark unhold' will remove the hold and allow you to update the Qubes packages.
I suggest you restore the hold (apt-mark hold) to make sure that the Qubes p0ackages are not removed when updating other packages.