sudo DEBOOTSTRAP_OPTIONS="--keyring=/usr/share/keyrings/raspbian-archive-keyring.gpg" lb build 2>&1 | tee build.log
Note that you need the raspbian-archive-keyring package[1]. Alternatively, I think there's a different debootstrap option that just ignores the signatures altogether.
Again, no hard feelings if you deem this out of scope, but... maybe it suggests there's a bug in the bootstrapping phase? Because the repos in the chroot seem to not be respecting what I've configured:
(Note that /usr/share/keyrings/debian-archive-keyring.gpg most certainly exists on the host, but maybe it's talking about the chroot.)
I've also noticed that in my "real" project, the bootstrap phase seems to bypass my apt-cacher-ng instance (which is specified as a localhost:3142 URL in those same options). Am I missing some option for making the bootstrapping phase aware of the different repositories?