apt-get update public key problem

["John Biederstedt" <john@johnsdomain.org>]

Today I ran apt-get update and got this:
Ign cdrom://[Debian GNU/Linux testing _Etch_ - Official Snapshot i386
Binary-1 (20051107)] etch Release.gpg
Ign cdrom://[Debian GNU/Linux testing _Etch_ - Official Snapshot i386
Binary-1 (20051107)] etch Release
Get:1 http://ftp.us.debian.org testing Release.gpg [378B]
Hit http://ftp.us.debian.org testing Release
Ign http://ftp.us.debian.org testing Release
Hit http://ftp.us.debian.org testing/main Packages
Hit http://ftp.us.debian.org testing/main Sources
Get:2 http://security.debian.org testing/updates Release.gpg [189B]
Hit http://security.debian.org testing/updates Release
Hit http://security.debian.org testing/updates/main Packages
Hit http://security.debian.org testing/updates/contrib Packages
Fetched 379B in 8s (44B/s)
Reading package lists... Done
W: GPG error: http://ftp.us.debian.org testing Release: The following
signatures couldn't be verified because the public key is not available:
NO_PUBKEY 010908312D230C5F
W: You may want to run apt-get update to correct these problems



I install debian-keyring, and set up a link for debian-archive so
apt-key update would work.  I became root and imported the debian
keyring (all of them), and added the debian-roles keyring as well.  I
also assigned ultimate trust to the debian role keys.

The above still happens.  From googling around, there seems to be a bug
referencing this or something like it, but I'm curious if others have
had the same problem, and if anyone has found a workaround, or a way to
verify the packages.  I've hunted around www.debian.org for keys, and am
still looking.  I'd like to know if anyone is aware if this is a bug, or
if the archives are compromised somehow.  I'm sending this to
debian_user since it seems to me more like a user issue than a real
testing issue.

Any info is greatly apperciated,

John