Fix stale ondrej/php RSA-1024 key warning on alpha; document the gotcha

add-apt-repository --remove silently no-op'd against the existing
non-standard-named .sources file left over from an earlier release
upgrade. Removed the stale source/key manually and re-added the PPA
fresh - now embeds Signed-By inline, no more separate trusted.gpg.d
keyring file. Verified clean apt update, no package churn, dyndns and
sanity-check still pass.

SETUP.md

@@ -645,6 +645,29 @@ the release upgrade completes is what actually finishes the job. Check
 assuming a completed `do-release-upgrade` run means everything is
 current.
 
+**A `Signature ... uses weak algorithm (rsa1024)` warning on this PPA is
+a Launchpad-wide artifact, not a sign this PPA is untrustworthy or
+compromised** — Launchpad signed every PPA with one shared RSA-1024 key
+from 2009 until re-signing everything with RSA-4096 by August 2024;
+newer apt versions just started warning about the *old* cached copy of
+that key wherever it's still present locally. If it shows up, don't
+just live with it or assume something's wrong with the PPA — remove the
+stale source file and key and re-add the PPA fresh:
+```bash
+sudo rm /etc/apt/sources.list.d/ondrej-ubuntu-php-*.sources \
+        /etc/apt/trusted.gpg.d/ondrej_ubuntu_php.gpg   # if present - old key file
+sudo add-apt-repository -y ppa:ondrej/php
+```
+**`add-apt-repository --remove` doesn't reliably work here if the
+existing source file has a non-standard name** (e.g. a
+`...-focal.sources` file left over from an earlier release-upgrade
+rename, as happened on this host) — its matching logic can silently no-op
+or touch an unrelated entry instead. Deleting the old `.sources`/key
+files directly and re-adding fresh, as above, is the reliable path.
+A freshly-added PPA now embeds the signing key inline via `Signed-By:`
+in the `.sources` file itself (modern deb822 style) rather than a
+separate `/etc/apt/trusted.gpg.d/*.gpg` keyring file.
+
 For each subdomain (static site, dyndns, mail webmail-proxy, any
 Docker-backed app): create `/etc/apache2/sites-available/<name>.conf` with
 a `:80` vhost, `a2ensite`, then let certbot handle TLS + the redirect:

TODO.md

@@ -672,8 +672,8 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       Root usage barely moved (already 10% with 136G free beforehand) -
       this was dead-weight removal, not a space-pressure fix.
 
-- [ ] **Stale RSA-1024 signing-key warning from the `ondrej/php` PPA** — found 2026-07-26
-      `apt update` on alpha prints: "Signature by key
+- [x] **Stale RSA-1024 signing-key warning from the `ondrej/php` PPA** — found and fixed 2026-07-26
+      `apt update` on alpha printed: "Signature by key
       14AA40EC0831756756D7F66C4F4EA0AAE5267A6C uses weak algorithm
       (rsa1024)" for `ppa:ondrej/php`. Researched before acting rather
       than assuming the PPA itself is compromised or poorly run: this is
@@ -684,14 +684,26 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       in noble) only just started warning about it everywhere. Launchpad
       finished re-signing every affected PPA with RSA-4096 by August
       2024 (confirmed via Launchpad's own answers/support tracker); the
-      warning persists here only because apt's local keyring still has
+      warning persisted here only because apt's local keyring still had
       the *old* cached key. No evidence of any compromise or malware
       incident tied to this PPA.
-      **Fix, not yet applied**: remove and re-add the PPA
-      (`sudo add-apt-repository --remove ppa:ondrej/php && sudo
-      add-apt-repository ppa:ondrej/php`) to force-fetch the current
-      RSA-4096 key and clear the warning. Purely cosmetic/stale-cache,
-      not an active security exposure, so low priority - but worth doing
-      next time other apt maintenance is being done on alpha. Also
-      update `SETUP.md`'s `ondrej/php` note (currently just says "check
-      the `Suites:` line") to mention this exact warning and fix.
+      Fixed: `add-apt-repository --remove ppa:ondrej/php` didn't
+      actually touch anything - the existing source file was a leftover
+      non-standard name (`ondrej-ubuntu-php-focal.sources`, a naming
+      artifact from an earlier release-upgrade rename) that its removal
+      logic didn't match, and it added/removed an unrelated
+      launchpadcontent.net entry instead. Backed up the old
+      `.sources` file and the old key (`/etc/apt/trusted.gpg.d/
+      ondrej_ubuntu_php.gpg`) to `/root/apt-backup-ondrej-php/`,
+      deleted both manually, then `add-apt-repository ppa:ondrej/php`
+      fresh - created a correctly-named `ondrej-ubuntu-php-noble.sources`
+      pointing at `https://ppa.launchpadcontent.net/ondrej/php/ubuntu/`
+      with the current key embedded inline via `Signed-By:` (modern
+      deb822 style, no more separate `trusted.gpg.d` keyring file at
+      all). Verified: `apt update` clean, no rsa1024 warning; same
+      package version still installed/candidate (no unwanted churn);
+      `dyndns.jayfield.org` still `401`s; `sanity-check.sh` full pass
+      (48/48) immediately after. Noted in passing: Ondřej's own PPA
+      description says this repo "is in process of being merged into
+      https://packages.sury.org/php/" - a future migration to watch for,
+      not an action item yet.