openstack-ansible-security/doc/source/developer-notes/V-38487.rst

The Ansible task for V-38462 already checks for apt configurations that would
disable any GPG checks when installing packages. However, it's possible for
the root user to override these configurations via command line parameters.