Overriding apt-get security check in Debian 9 (stretch) for Cloudera upgrade

Question

I am trying to update Cloudera packages on several servers that have recently been upgraded to Debian 9 (stretch). The latest updates for Cloudera were for Debian 8 (jessie). The update/upgrade fails because Debian 9 thinks that Cloudera's GPG signature is invalid (not secure enough, I think?).

Is there a way I get around this issue and force Debian to update/upgrade the packages, whether or not it dislikes the GPG key?

Things I've tried that haven't worked:

Adding [trusted=yes] to /etc/apt/sources.list, e.g.:

deb [trusted=yes] http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 contrib

Telling (I think) apt-get to not worry about the authentication, e.g.:

# apt-get --allow-unauthenticated update
# apt-get --allow-unauthenticated upgrade

Adding a file to /etc/apt/apt.conf.d with the following contents does not work.

APT{ Get { AllowUnauthenticated "1"; }; };

What to do?

EDITED: Here's the error I get from apt-get:

Err:4 http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease
  The following signatures were invalid: F36A89E33CC1BD0F71079007327574EE02A818DD
Error: GDBus.Error:org.freedesktop.DBus.Error.TimedOut: Failed to activate service 'org.freedesktop.PackageKit': timed out
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease: The following signatures were invalid: F36A89E33CC1BD0F71079007327574EE02A818DD
W: Failed to fetch http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh/dists/jessie-cdh5/InRelease  The following signatures were invalid: F36A89E33CC1BD0F71079007327574EE02A818DD

Answer 1

The unauthenticated things allow unsigned repositories or repositories whose key is not available to be used. This case is slightly different as there is key but it is invalid.

One option around this is to remove the key locally and then the unauthenticated options function as expected. To remove the key run

sudo apt-key del F36A89E33CC1BD0F71079007327574EE02A818DD.

sudo apt-get update should then be much happier.