I can’t see any bug. This is what I see on that page:
Use either your browser or curl to download. Using curl assumes you know the correct package name as located with the mirror. Replace YYYYMMDD-R as available from the mirror.
user $ curl -O https://mirror.easyname.at/manjaro/pool/overlay/manjaro-keyring-YYYYMMDD-R-any.pkg.tar.zst
user $ curl -O https://mirror.easyname.at/manjaro/pool/sync/archlinux-keyring-YYYYMMDD-R-any.pkg.tar.zst
Notice the difference? The archlinux-keyring is located in the /pool/sync/ folder, not the /pool/overlay/ folder.