Це стара версія документу!
Things become more and more complicated, so I decided to write instruction
You should always put signing key path to repository, like this:
deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_16.x jammy main
The key MUST NOT be placed in /etc/apt/trusted.gpg.d or loaded by apt-key add
If future updates to the key will be managed by an apt/dpkg package, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally, it SHOULD be downloaded into /etc/apt/keyrings instead.
I think it means if you need to bother with key, then just put it to /etc/apt/keyrings
There are two ways, depending on what package developer implemented
First, download the key from keyserver to local user storage:
gpg --keyserver keyserver.ubuntu.com --recv-keys D33A1BD725ED047D
Another keyserver: keys.openpgp.org
After that export key to file and put it to keyring directory:
gpg --export D33A1BD725ED047D |sudo tee /etc/apt/keyrings/usefulpackage.gpg
I didn't find out whether key should be ascii-armored or not. Most likely should be unarmored (binary).
curl https://dbeaver.io/debs/dbeaver.gpg.key > dbeaver.gpg
Check if key is armored (looks like ASCII text and not binary), and if so, unarmor it:
curl https://dbeaver.io/debs/dbeaver.gpg.key | gpg --dearmor > dbeaver.gpg
Move the key to /etc/apt/keyrings:
mv dbeaver.gpg /etc/apt/keyrings/