- only possible upgrade path for packages installed from Makefile.extras
- leave it disabled as we don't want third-party APT sources in the default setup
- the GPG signing key is not trusted by default and must be manually trusted by the administrator