@briankrebs On the other hand, https://updates.signal.org/desktop/apt/keys.asc signed https://updates.signal.org/desktop/apt/dists/xenial/Release as https://updates.signal.org/desktop/apt/dists/xenial/Release.gpg, which in turn matches https://updates.signal.org/desktop/apt/dists/main/binary-amd64/Packages and https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_7.24.1_amd64.deb