@whitequark does https://wiki.debian.org/SecureApt#Setting_up_a_secure_apt_repository. help? IIRC you need to explicitly sign the Release files and set some policy, but it's been a while.