A package signing key rotates in the build stage, but the downstream install test still trusts only the old fingerprint and rejects the freshly built repository

The package was published correctly, yet the validation environment pins a previous trust root.