Dear Maintainer,
systems newly created by debootstrap still use the old sources.list format, whereas apt warns when the newer deb822 format is not used.
Here is a sequence of commands to reproduce the problem:
# debootstrap sid foobar
# systemd-nspawn -D foobar
# apt update
Hit:1 http://deb.debian.org/debian sid InRelease
Get:2 http://deb.debian.org/debian sid/main Translation-en [7332 kB]
Fetched 7332 kB in 2s (3694 kB/s)
All packages are up to date.
Notice: Missing Signed-By in the sources.list(5) entry for 'http://deb.debian.org/debian'
Notice: Consider migrating all sources.list(5) entries to the deb822 .sources format
Notice: The deb822 .sources format supports both embedded as well as external OpenPGP keys
Notice: See apt-secure(7) for best practices in configuring repository signing.
Thanks,