O apt finge que as chaves não estão disponíveis. Não é verdade

Excluí /var/lib/apt e /var/cache/apt porque tive problemas estranhos com o apt dos quais não consegui me livrar.

Agora eu sempre recebo:

Get:1 http://security-cdn.debian.org buster/updates InRelease [65.4 kB]
Err:1 http://security-cdn.debian.org buster/updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
Reading package lists... Done
W: GPG error: http://security-cdn.debian.org buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
E: The repository 'http://security.debian.org buster/updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Isso claramente não é verdade. Mas ok, exclua /etc/apt/trusted.gpg e dê outro novo começo:

# rm /etc/apt/trusted.gpg
# apt-key adv --keyserver pgp.mit.edu --recv-keys AA8E81B4331F7F50
Executing: /tmp/apt-key-gpghome.DwxpIbllfu/gpg.1.sh --keyserver pgp.mit.edu --recv-keys AA8E81B4331F7F50
gpg: key EDA0D2388AE22BA9: public key "Debian Security Archive Automatic Signing Key (9/stretch) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
# apt-key adv --keyserver pgp.mit.edu --recv-keys 112695A0E562B32A
Executing: /tmp/apt-key-gpghome.TFiPCm4ThF/gpg.1.sh --keyserver pgp.mit.edu --recv-keys 112695A0E562B32A
gpg: key 4DFAB270CAA96DFA: public key "Debian Security Archive Automatic Signing Key (10/buster) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
# apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2017-05-22 [SC] [expires: 2025-05-20]
      6ED6 F5CB 5FA6 FB2F 460A  E88E EDA0 D238 8AE2 2BA9
uid           [ unknown] Debian Security Archive Automatic Signing Key (9/stretch) <[email protected]>
sub   rsa4096 2017-05-22 [S] [expires: 2025-05-20]

pub   rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
      5E61 B217 265D A980 7A23  C5FF 4DFA B270 CAA9 6DFA
uid           [ unknown] Debian Security Archive Automatic Signing Key (10/buster) <[email protected]>
sub   rsa4096 2019-04-14 [S] [expires: 2027-04-12]

# apt update
Get:1 http://security-cdn.debian.org buster/updates InRelease [65.4 kB]
Err:1 http://security-cdn.debian.org buster/updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
Reading package lists... Done
W: GPG error: http://security-cdn.debian.org buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
E: The repository 'http://security.debian.org buster/updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Apt apenas mostra mensagem longe da realidade. Está mentindo! Como pode ser?

PS: Devo dizer que criei um backup de /var/lib/apt e /var/apt/cache antes de excluí-los. Quando copio o backup de volta, nenhuma alteração. Parece que algo mais está quebrado.

PSS: Também apaguei /etc/apt, /var/lib/apt, /var/cache/apt e reinstalei o apt via "dpkg -i apt_1.8.2_amd64.deb". Todos os diretórios são recriados do zero, mas o apt update ainda falha com o mesmo erro!