I have an Ansible script that setup google chrome apt repo. I keep Google's signing key together with the scripts (rather than download it every time) because I think it minimizes the chance of getting malicious key (TOFU security model).
Now the key no longer works:
W: GPG error: http://dl.google.com/linux/chrome/deb stable Release:
The following signatures couldn't be verified because the public key
is not available: NO_PUBKEY 78BD65473CB3BD13
E: The repository 'http://dl.google.com/linux/chrome/deb stable Release' is not signed.
The url from which I've originally downloaded it points to a different key (as in: the files differ). Moreover, I tried getting the key by fingerprint from a different source:
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 78BD65473CB3BD13
apt-key export 78BD65473CB3BD13
And I got yet another, different file. Which one should I use? How do I make sure that I can trust it? Is there a way to check that the old key just expired and the new one is a valid successor?