I started reading on apt and the security changes to always use GPG signing keys, but further saw that it by default uses all configured GPG signing keys, this seems like a small but unecessary loophole. It looks to be standard for custom repositories to restrict the signing keys to its corresponding key.
However, I cannot seem to find anyone who restricts the standard repositories to their respective keys. What am missing?
