From time to time, a GPG key used by APT to verify package signatures may expire. APT then refuses to install or upgrade packages signed by this key. The expired key can be replaced as follows (commands to be executed as root):

apt-key del <expired-key>
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <new-key>

<expired-key> and <new-key> refer to the GPG IDs of the expired and new key, respectively. If you don't know them, you can get them as follows. When executing

apt-get upgrade

APT will complain about the repository that cannot be upgraded any more because of the expired key. However, the GPG ID of the affected key is not printed, unfortunately. Therefore one has to list all APT keys with

apt-key list

and to read off the GPG ID wanted. In general, the key will just be replaced by a new one with the same ID, but a more up-to-date signature; in this case, <new-key> = <expired-key>. If this is not the case, performing

apt-get update

will complain about the missing key, this time directly indicating the GPG ID of the missing key.