Packages authentication
If you want apt to verify the downloaded packages, you can either
install the debian-ports-archive-keyring package or manually import
the Debian ports archive key into apt [...]
Rather than trying to see how the GPG key is incorrectly handled and also considering that using apt-key is deprecated and might disappear soon, an alternate method requiring also a separate running Debian system (of any architecture because the package has no architecture, and at least of stable release) can be used. I'd rather install the package providing the authentication method for the repository: debian-ports-archive-keyring without having to know how it's exactly implemented or could change in the future.
To bootstrap the source of trust and avoid a chicken-and-egg trust problem, one can ask an other Debian system to give information for the valid package. So, the command below should be run on an other Debian system that is correctly validating its repository sources (no need to be root, but root should have performed apt update recently):
$ apt-get --print-uris --reinstall install debian-ports-archive-keyring
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
debian-ports-archive-keyring
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 29.7 kB of archives.
After this operation, 52.2 kB of additional disk space will be used.
'http://deb.debian.org/debian/pool/main/d/debian-ports-archive-keyring/debian-ports-archive-keyring_2022.02.15%7edeb11u1_all.deb' debian-ports-archive-keyring_2022.02.15~deb11u1_all.deb 29692 MD5Sum:698ade2c82f6319d63a491231c4f0417
This provides the location where to retrieve the package rather than attempt to download and install it, and along this a size and checksum validating this is the correct package. It will have itself validated this information by verifying the GPG signature of the ..._bullseye_InRelease (or an other release rather than bullseye) file which covers the validity of the ..._main_binary-XXX_Packages file (with XXX the architecture of the other Debian system and which doesn't matter for a package without architecture) providing the information on the target package. Both files are present in /var/lib/apt/lists/.
This allows to download by any mean and in any place (by altering slightly the URL) the package debian-ports-archive-keyring_2022.02.15~deb11u1_all.deb and then verify its size and checksum using for this case md5sum.
Once downloaded and verified , this package can be installed on the target system using dpkg -i ... (it depends on nothing which conveniently avoids having to recursively do this method for every dependency which would be more difficult if there were packages having an architecture), and then the system upgraded as usual. debian-ports-archive-keyring will likely be upgraded in the process.
