Pin each APT source to its own OpenPGP key

This is made possible by APT 1.1, that should be in Debian Stretch. It’s probably not a 3.0 release blocker.

Original created by @intrigeri on 10234 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information