APT repo signature rejected because SHA1 is not considered secure

[flips]

Trying to add the repo on Debian (13/Trixie):

Err:9 https://s3.amazonaws.com/repo.deb.cyberduck.io stable InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on DC9028103CF5FCB63E1C8409F7FAE1F32DA69515 is not bound:            primary key   because: No binding signature at time 2026-03-03T17:17:59Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Warning: OpenPGP signature verification failed: https://s3.amazonaws.com/repo.deb.cyberduck.io stable InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on DC9028103CF5FCB63E1C8409F7FAE1F32DA69515 is not bound:            primary key   because: No binding signature at time 2026-03-03T17:17:59Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Error: The repository 'https://s3.amazonaws.com/repo.deb.cyberduck.io stable InRelease' is not signed

So, wasn't sure if I should just open an issue for this repo, or how to best report this. 😇

[dkocher]

We should replace our SHA1 signing keys, also discussed in #17821.