debootstrap will try to authenticate Debian-based repos against a locally
installed Debian archive keyring, or Ubuntu-based repos against a locally
installed Ubuntu archive keyring. If there's no keyring packages installed
(as is the case in our CI) then the repos are blindly accepted without
auth. However, if you have a keyring installed and use a "weird" repo
which doesn't work with the expected default keyring (e.g. out of the box
it'll try to authenticate the Raspbery Pi OS repo against the Debian
keyring file) it fails.

So, for our Rasbian case, a) specify the path to the known-good Raspbian
archive keyring file and b) add a check where if a keyring is specified
but does not exist, drop it. This allows building the Raspbian rootfs
both locally on systems with debian-archive-keyring and in CI with no
keyrings available.

We should consider forcing keyring validation in general though, for
better build integrity as a whole.