An Ubuntu apt migration adds signed-by cleanly and one host still fails

A repository trust migration is rolled out and later one host class keeps failing apt update despite the new signed-by config being present.