apt doesn't have permission to read package signing pubkey

[qrkourier]

reported in Discourse: https://openziti.discourse.group/t/bad-inrelease-signatures-at-https-packages-openziti-org-zitipax-openziti-deb-stable/1517/3?u=qrkourier

apt drops privs before attempting to read the package signing pubkey imported in /usr/share/keyrings/openziti.gpg by anyone following our install instructions or running the Ubuntu install script.

Alternatives include importing the package signing pubkey into the default keyring instead of creating a new one, but that contradict's the guidance to adopt this new pattern of separate keyrings for third party repos.

The Discourse user's suggestion of ensuring the openziti.gpg keyring file is other-readable makes sense to me.