apt-key is deprecated. clarify instructions?

Question

following instructions at https://support.torproject.org/apt/tor-deb-repo/ step 3:

3. Then add the gpg key used to sign the packages by running the following commands at your command prompt
   # wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import

   # gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -

results in

"Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)). E: This command can only be used by root."

could someone update/correct/clarify the instructions?

Answer 1

The Debian instructions for the new way to connect to a third-party repository are at https://wiki.debian.org/DebianRepository/UseThirdParty. The new method is as follows.

Download the ASCII armored key over HTTPS, dearmor it if necessary, and store it in /usr/share/keyrings. For Tor, that would look like this:

wget -O- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg

Create the sources.list entry in a new file in /etc/apt/sources.list.d/ named tor.list. The entry should have the signed-by option set, and it should point to a file rather than a fingerprint. For Tor, the file /etc/apt/sources.list.d/tor.list would contain a line:

deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org <DISTRIBUTION> main