[main] Fix certificate selection for debs and fix signing validation for the new key (and all future new keys) (#2724)

Author: github-actions[bot]

src/arcade/src/Microsoft.DotNet.Arcade.Sdk/tools/Sign.props

@@ -105,9 +105,10 @@
     <AzureLinuxRPM Include="$(ArtifactsPackagesDir)**/*-azl.*-*.rpm" />
     <FileSignInfo Include="@(AzureLinuxRPM->'%(Filename)%(Extension)')" CertificateName="LinuxSignMariner" />
 
-    <!-- Explicitly use the "new" LinuxSign cert. TODO: Update the cert name to the actual name in MicroBuild once it's added. -->
-    <NewKeyLinuxRPM Include="$(ArtifactsPackagesDir)**/*-newkey-*.rpm" />
-    <FileSignInfo Include="@(NewKeyLinuxRPM->'%(Filename)%(Extension)')" CertificateName="LinuxSign500207PGP" />
+    <!-- Explicitly use the "new" LinuxSign cert. -->
+    <NewKeyLinuxPackage Include="$(ArtifactsPackagesDir)**/*-newkey-*.rpm" />
+    <NewKeyLinuxPackage Include="$(ArtifactsPackagesDir)**/*-newkey-*.deb" />
+    <FileSignInfo Include="@(NewKeyLinuxPackage->'%(Filename)%(Extension)')" CertificateName="LinuxSign500207PGP" />
   </ItemGroup>
 
   <!-- The name of the .NET specific certificate, which is a general replacement for Microsoft400

src/arcade/src/Microsoft.DotNet.SignTool/src/VerifySignatures.cs

@@ -262,7 +262,8 @@ private static void DownloadAndConfigurePublicKeys(string tempDir)
         {
             string[] keyUrls = new string[]
             {
-                "https://packages.microsoft.com/keys/microsoft.asc", // Microsoft public key
+                "https://packages.microsoft.com/keys/microsoft.asc", // SHA-1 Microsoft public key
+                "https://packages.microsoft.com/keys/microsoft-rolling.asc", // Non-SHA1 Microsoft public keys for non-Azure Linux distributions
                 "https://raw.githubusercontent.com/microsoft/azurelinux/3.0/SPECS/azurelinux-repos/MICROSOFT-RPM-GPG-KEY" // Azure linux public key
             };
             foreach (string keyUrl in keyUrls)

src/arcade/src/SignCheck/Microsoft.SignCheck/Utils.cs

@@ -200,6 +200,7 @@ public static void DownloadAndConfigurePublicKeys(string tempDir)
             string[] keyUrls = new string[]
             {
                 "https://packages.microsoft.com/keys/microsoft.asc", // Microsoft public key
+                "https://packages.microsoft.com/keys/microsoft-rolling.asc", // Non-SHA1 Microsoft public keys for non-Azure Linux distributions
                 "https://raw.githubusercontent.com/microsoft/azurelinux/3.0/SPECS/azurelinux-repos/MICROSOFT-RPM-GPG-KEY" // Azure linux public key
             };
             foreach (string keyUrl in keyUrls)