apt signed-by test repository isolation with apt_preferences pinning

Goal is to evaluate a Debian package integration against a non-production repository without using production credentials or keys.

apt supports separate sources.list entries and apt_preferences pinning for test suites, and signed-by allows a dedicated keyring per repository to isolate verification from production keys. The unresolved decision is how to trust a local test mirror that has no production signing key, since apt rejects unsigned Release files by default and forces a choice between test key management or temporary trust overrides.

Version assumptions matter because release codenames and pin priority interactions are version sensitive, and behavior with partial metadata and mixed suites is not deterministic across Debian releases.

Does apt perform signature verification via signed-by before applying pin priorities from apt_preferences? What configuration keeps a test keyring isolated from production keys while still allowing apt update to succeed for a local mirror? Is AllowInsecureRepositories acceptable for isolated integration testing, or does it introduce risks beyond signature bypass?