This error sounds alarming and is actually reassuring: apt found a repository it cannot verify, and it stopped instead of trusting it. Your job is to fetch the one missing public key - from its real owner, bound to its one repository.
Buried in the update output is a line like NO_PUBKEY 871920D1991BC93C, or the blunt verdict that a repository "is not signed". Neither means your system is broken - both mean a signature could not be verified, and apt will not take software from a source it cannot verify. This page explains what the check protects, how to install the missing key the modern per-repository way, and how to handle the case where Ubuntu's own keyring is the one that is damaged.
Every proper repository signs its package list with a private key, and your PC verifies that signature with the matching public key before trusting a single package name. NO_PUBKEY means the signature exists but the public key is missing on your machine - common after adding a third-party repository by hand, restoring a system, or when a project rotates its key. The companion message, "The repository ... is not signed", is stricter: no usable signature at all, and apt flatly refuses that source. Both are the lock working as designed. The fix is to install the correct key - never to switch the check off.
apt prints the exact key it needs: the hex string after NO_PUBKEY. Write it down exactly - every character matters, and a key ID belongs to one specific repository. A key that "almost matches" is a different key. Also note which repository the error names: if it is a third-party source you added, its key comes from that project's own official instructions. If the error names Ubuntu's own archive, the fix is usually to reinstall Ubuntu's keyring package, covered below.
If the missing key belongs to archive.ubuntu.com itself, the keyring package on your PC is probably damaged or was removed. Reinstall it: sudo apt-get install --reinstall ubuntu-keyring. If apt refuses to do even that because of the key error, download the ubuntu-keyring package (.deb) for your release from packages.ubuntu.com using a browser, install it with sudo dpkg -i ubuntu-keyring*.deb, then run sudo apt update again. And one honest check before all of this: a wrong system clock can also make valid signatures fail verification - glance at date first, it takes five seconds.
--allow-insecure-repositories or --allow-unauthenticated. Those flags tell apt to install packages it could not verify - which removes the exact protection this error exists for. A repository whose key you cannot obtain from its publisher's official site is a repository to remove, not to trust blindly.The video shows the NO_PUBKEY error, fetching the correct key, and the update verifying cleanly.
▶️ Watch Full VideoThe error itself is protection working, not an attack: apt detected a signature it cannot verify and refused to trust that source. It becomes dangerous only if you bypass it with insecure flags, because then packages from that source install without any proof of who published them. Install the correct key from the publisher's official site, or remove the repository - those are the two safe outcomes.
apt-key adds keys to one global store, and any key in that store can vouch for any repository on the system - far more trust than one key should have. The modern method stores each key in its own file under /etc/apt/keyrings and ties it to its single repository with signed-by, so a key can only ever verify the source it was installed for. apt-key still functions on current releases but prints deprecation warnings, and it is the weaker choice whenever a publisher offers keyring instructions.
Almost certainly the key step. Adding a deb line tells apt where the repository is, but most third-party repositories also require their signing key to be installed before the first update. The publisher's installation instructions always include it - a keyring download or a key package. Go back to the official instructions, do the key step exactly as written there, and run sudo apt update again.