Check the signature on each downloaded apt Release file.

check-apt-signatures.sh

#!/bin/bash

# Import apt keys into GPG keyring for ease of use.
apt-key list | grep ^/ | xargs -n1 gpg --import > /dev/null 2>&1

bad=0

# Check the signature on each apt list.
for file in /var/lib/apt/lists/{*_Release,*_InRelease}; do
    gpg --verify $file > /dev/null 2>&1
    if [ $? -ne 0 ]; then
        let bad=$bad+1
        if [ $bad -eq 1 ]; then
            echo "Could not validate signature on apt list(s):"
        fi
        echo "    $file"
    fi
    if [ $bad -eq 0 ]; then
        echo "All apt lists validated successfully."
    fi
done