Dear Maintainer,

I installed my system via chroot as bookworm, then upgraded to trixie.
Once trixie was upgraded I was prompted to run

# apt modernize-sources

After running this and then an

# apt update

There was an error present saying that the SignedBy field was empty
in the debian-backports.sources file

I resolved this by manually copying the SignedBy gpg key location from
the debian.sources file to the debian-backports.sources file.

Confirming this bug is still present 10+ months after the original report,
on a fresh dist-upgrade from bookworm to a fully patched trixie 13.4.

System details:
  apt --version:        apt 3.0.3 (amd64)
  /etc/debian_version:  13.4
  uname -a:             Linux 6.12.74+deb13+1-amd64 #1 SMP PREEMPT_DYNAMIC
                        Debian 6.12.74-2 (2026-03-08) x86_64 GNU/Linux

Reproducer (same as #1107140):
  1. System upgraded from bookworm to trixie.
  2. Run: sudo apt modernize-sources
  3. The migrator correctly creates /etc/apt/sources.list.d/debian.sources
     with three stanzas (trixie, trixie-security, trixie-updates), each
     with Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg.
  4. The migrator also creates
/etc/apt/sources.list.d/debian-backports.sources,
     but its Signed-By field is left empty.
  5. `apt update` then emits:
        Notice: Missing Signed-By in the sources.list(5) entry for
        'http://deb.debian.org/debian'

Resulting file (/etc/apt/sources.list.d/debian-backports.sources):

  # Modernized from /etc/apt/sources.list
  Types: deb
  URIs: http://deb.debian.org/debian/
  Suites: trixie-backports
  Components: main non-free-firmware
  Signed-By:

Note the trailing space after `Signed-By:` — the field is emitted with the
key but no value, not omitted entirely. Whatever code path resolves the
default keyring for trixie/trixie-security/trixie-updates is not being
applied to trixie-backports, even though backports is signed by the same
debian-archive-keyring.

Workaround for affected users:
  sudo sed -i 's|^Signed-By:[[:space:]]*$|Signed-By:
/usr/share/keyrings/debian-archive-keyring.gpg|' \
    /etc/apt/sources.list.d/debian-backports.sources

Related observation — keyring path:
The trixie release notes (section 4, "Upgrades from Debian 12 (bookworm)")
recommend switching Signed-By entries to the canonical `.pgp` keyring
pathnames, since the backwards-compatible `.gpg` symlinks "will eventually
disappear":

  $ ls -la /usr/share/keyrings/debian-archive-keyring.gpg
  lrwxrwxrwx ... debian-archive-keyring.gpg -> debian-archive-keyring.pgp

However, `apt modernize-sources` itself currently writes `.gpg` (not `.pgp`)
into the generated debian.sources for trixie/trixie-security/trixie-updates.
If the fix for this bug fills in the missing Signed-By on backports, it
would be consistent (and forward-looking) to use `.pgp` directly in the
migrator output rather than perpetuating the `.gpg` symlink. Otherwise
users following the release notes will end up with mixed paths in
neighbouring stanzas.

Happy to provide additional logs or test a patched apt if useful.