## TL;DR
Signatures were invalid means the Release file signature does not verify against any key apt trusts on this host. Find which repository apt names, fetch the current signing key from that vendor (vendors rotate keys), install it into a per-repo keyring file referenced by signed-by in the source entry, and remove the stale key.

```text
apt update failed gpg error the following signatures were invalid
```

## Use this when
- apt update prints GPG error and The following signatures were invalid for one repository.
- The error names a key ID or a vendor repo such as Docker, Kubernetes, or a PPA.
- The repo worked before and broke without local changes, suggesting key rotation.

## Not for this skill when
- apt update fails with network errors to the repo. That is connectivity, not signature trust.
- The package itself fails signature checks during install from a local file. That is a different verification path.

## Steps
1. Run apt update and note the exact repository URL and key ID in the error. Verify: one repo and key are identified
2. Get the vendor current signing key from the vendor official documentation page for that repo. Verify: the key fingerprint matches what the vendor publishes
3. Install the key as a dearmored keyring file under the trusted keyrings directory and add signed-by pointing at it in that repo source entry. Verify: the source entry references the new keyring
4. Remove the old key from the legacy trusted store if it was added with apt-key. Verify: apt-key list or the keyring folder no longer shows the expired key for that repo
5. Run apt update again. Verify: the repo is read without GPG errors and package lists refresh

## Variant phrasings
### apt signatures invalid EXPKEYSIG fix
The expired-key variant code phrasing.
### NO_PUBKEY apt update missing public key
The missing-key sibling error in the same family.
### apt-key deprecated signed-by keyring fix
The modern keyring method phrasing.

Compatibility: Compatibility: Debian and Ubuntu with apt 2.x and the signed-by keyring model; legacy apt-key exists but is deprecated.

## Why it happens
Repositories sign their Release metadata, and apt refuses metadata it cannot verify. Vendors rotate signing keys on schedules and after incidents, and long-lived images carry the old key forever. Per-repo keyrings replaced the global apt-key store because a global key lets any repo sign packages for any other repo name.

## Edge cases / pitfalls
- Never fix this by disabling signature checks globally; that removes the supply-chain protection apt is enforcing.
- A wrong system clock makes valid signatures look expired or not yet valid; check date before replacing keys on a fresh VM.
- Copying a keyring file from another host works only if it is the same vendor key; verify fingerprints either way.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-q-gaaljnzxjb7Oqu9dpuQ