TODO.md: track the stale ondrej/php RSA-1024 key warning as an open item

Researched first - Launchpad-wide re-signing artifact, not a live
compromise or maintainer issue. Low-priority cosmetic fix, not applied
yet: re-add the PPA to pick up the current RSA-4096 key.

TODO.md

@@ -671,3 +671,27 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       to 12%; `sanity-check.sh` full pass (48/48) immediately after.
       Root usage barely moved (already 10% with 136G free beforehand) -
       this was dead-weight removal, not a space-pressure fix.
+
+- [ ] **Stale RSA-1024 signing-key warning from the `ondrej/php` PPA** — found 2026-07-26
+      `apt update` on alpha prints: "Signature by key
+      14AA40EC0831756756D7F66C4F4EA0AAE5267A6C uses weak algorithm
+      (rsa1024)" for `ppa:ondrej/php`. Researched before acting rather
+      than assuming the PPA itself is compromised or poorly run: this is
+      a **Launchpad-platform-wide** artifact, not specific to Ondřej
+      Surý (a long-established Debian Developer maintaining PHP
+      packaging since PHP 5) or this PPA - Launchpad signed *all* PPAs
+      with one RSA-1024 key since 2009, and newer apt versions (shipped
+      in noble) only just started warning about it everywhere. Launchpad
+      finished re-signing every affected PPA with RSA-4096 by August
+      2024 (confirmed via Launchpad's own answers/support tracker); the
+      warning persists here only because apt's local keyring still has
+      the *old* cached key. No evidence of any compromise or malware
+      incident tied to this PPA.
+      **Fix, not yet applied**: remove and re-add the PPA
+      (`sudo add-apt-repository --remove ppa:ondrej/php && sudo
+      add-apt-repository ppa:ondrej/php`) to force-fetch the current
+      RSA-4096 key and clear the warning. Purely cosmetic/stale-cache,
+      not an active security exposure, so low priority - but worth doing
+      next time other apt maintenance is being done on alpha. Also
+      update `SETUP.md`'s `ondrej/php` note (currently just says "check
+      the `Suites:` line") to mention this exact warning and fix.