Why KEYWORDS="-*" is a really stupid thing
==========================================
There is a bad practice in Gentoo going on to use KEYWORDS="-*" as a replacement
for package.mask to hardmask a package. This has even be encouraged by some people
in the distant past, but is a really really stupid idea. Why?
Because it screws KEYWORDS semantics, which are as follows (simplified):
KEYWORDS="foo"  - Known to work on foo
KEYWORDS="~foo" - Expected to work on foo
KEYWORDS=""     - Unknown status on foo
KEYWORDS="-foo" - Known to definitely not work on foo

Now KEYWORDS="-*" is an extension to the last case, meaning "Known to definitely
not work on anything (unless overridden by other keywords)". This makes sense
in the case of KEYWORDS="-* foo" for binary packages that will only ever work on
one/a few archs. However it clearly doesn't make sense to be used standalone,
as who would want a package that is known to definitely not work on anything
in the tree (ignoring the question who would develop such a thing in the first 
place).
The difference to package.mask is that the latter is used to indicate a package
that may generally work but has some nasty side effects (from random segfaults
to data corruption or breaking other packages), however it's assumed to work 
somewhat.
From a (user) usability point of view package.mask is also superior as it 
requires devs to state the reason why it is masked (which portage can query and
display, which doesn't work with comments inside ebuilds).
There are also technical reasons why this is stupid, mainly because -* is handled
special in many cases, like ACCEPT_KEYWORDS="-*" clearing the list of accepted
keywords. It works in package.keywords, but that's more a bug than a feature.

Now people have told me that they need this so they can hardmask a package 
inside the ebuild instead of editing a different file in another location. While
I don't see the big deal there it's a perfectly valid request, however 
KEYWORDS="-*" is probably the most stupid implementation for such a feature
someone could come up with. So if people really need this feature they are 
invited to come up with a different implementation as in the long run 
KEYWORDS="-*" (without any other keywords) will be phased out, the KEYWORDS.stupid
warning in repoman is the first step for that.

UPDATE 1: As of portage-2.1.2 package.keywords supports a new ** token that 
completely disables the keyword visibility filter, so one can install packages
that have KEYWORDS="" (and packages that still use KEYWORDS="-*". Still those 
packages should *also* be listed in package.mask for the usability reasons given
above. SO there is no longer a reason to use KEYWORDS="-*".
UPDATE 2: As of portage-2.2 the meaning of -* in package.keywords will change
to match the general semantics of incrementals (like ACCEPT_KEYWORDS) and will 
reset the keyword filter list (e.g. all values from ACCEPT_KEYWORDS are ignored 
for the given atom).