How to fix W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is stored in legacy trusted.gpg keyring in APT

First, identify which keys are stored in the legacy location:

sudo apt-key list

This will show all keys with their fingerprints and which repositories they are associated with.

From the output of apt-key list, locate the key associated with the PPA mentioned in your warning message. You need the last 8 characters of the key ID (without spaces). For example, if the fingerprint is "DB08 5A08 CA13 B8AC B917 E0F6 D938 EC0D 0386 51BD", the key ID is "038651BD".

Export the key from the legacy keyring and save it to the proper modern location:

sudo apt-key export <KEY_ID> | sudo gpg --dearmor -o /etc/apt/keyrings/<descriptive_name>.gpg

Replace <KEY_ID> with the 8-character key ID and <descriptive_name> with something descriptive like "ppa-ubuntu-mozilla-security" or "ppa-deadsnakes".

Edit the corresponding sources list file, typically found in /etc/apt/sources.list.d/:

sudo nano /etc/apt/sources.list.d/<repository-file>.list

Find the line starting with "deb" and add the signed-by directive. Change from:

deb http://ppa.launchpad.net/user/ppa/ubuntu focal main

To:

deb [signed-by=/etc/apt/keyrings/<descriptive_name>.gpg] http://ppa.launchpad.net/user/ppa/ubuntu focal main

If the file uses the newer DEB822 format (deb822), add a new line instead: Signed-By: /etc/apt/keyrings/<descriptive_name>.gpg

After updating the repository configuration, remove the old key from the deprecated trusted.gpg:

sudo apt-key del <KEY_ID>

Where <KEY_ID> is the same 8-character key ID used earlier.

Run apt update to confirm the warning is resolved:

sudo apt update

The warning for the migrated key should no longer appear. Repeat steps 2-5 for any remaining keys generating warnings.