I publish a Debian repository.  It was signed with a 4096-bit GPG key, and has been merrily in use from Debian 7 and Debian 8 systems for some time.  Recently, one of my users reported that Debian 9 was having problems with it.  Specifically, apt-get update was yielding: Reading package lists... Done   W: GPG error: http://Debian-repository.JdeBP.info. stable InRelease: The following signatures were invalid: A71733F3CEBD655CB25A0DDCE1E3A497555CE68F   W: The repository 'http://Debian-repository.JdeBP.info. stable InRelease' is not signed.Note that unlike the people at Repo APT secure - apt-get update GPG signature were invalid and Frustrated with aptly and GPG signing I am not using aptly.  So clearly I am not suffering from an aptly bug of any kind.  (-:So what is the problem?
Debian 9, APT, and GPG error: ... InRelease: The following signatures were invalid:
debian;apt;repository