### Summary

Based on feedback from a mastodon ansible user:

The first example of https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#examples (the apt_key replacement) shows how a pgp key is downloaded and declared as trusted for a repository, but there is no validation of the key going on. Maybe the get_url task could include the checksum argument, to show that (and how) the key should be validated against a known good. Further down there is also an example of apt_key downloading a key without the id argument specified.

### Issue Type

Documentation Report

### Component Name

apt_key

### Ansible Version

```console
$ ansible --version
2.15
```


### Configuration

```console
# if using a version older than ansible-core 2.12 you should omit the '-t all'
$ ansible-config dump --only-changed -t all
none
```


### OS / Environment

none

### Additional Information

The examples all use https URLs, so they do not expose you to just arbitrary MITM; but many projects use untrusted public mirrors to distribute packages and public keys, and instead post the fingerprint of the public key on the non-mirrored first-party website. You are then supposed to verify the downloaded key against that fingerprint (unfortunately a manual action since they post a PGP fingerprint and not a checksum), in order to protect against rogue mirror operators (AFAIK).

### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct
try:
        
        rsp, info = fetch_url(module, url, use_proxy=True)
        if info['status'] != 200:
            module.fail_json(msg="Failed to download key at %s: %s" % (url, info['msg']))
        return rsp.read()
    except Exception:
        module.fail_json(msg="error getting key id from url: %s" % url, traceback=format_exc())
def get_key_id_from_file(module, filename, data=None):
    native_data = to_native(data)
    is_armored = native_data.find("-----BEGIN PGP PUBLIC KEY BLOCK-----") >= 0
    key = None
    cmd = [gpg_bin, '--with-colons', filename]
    (rc, out, err) = module.run_command(cmd, environ_update=lang_env(module), data=(native_data if is_armored else data), binary_data=not is_armored)
    if rc != 0:
        module.fail_json(msg="Unable to extract key from '%s'" % ('inline data' if data is not None else filename), stdout=out, stderr=err)
    keys = parse_output_for_keys(out)
    
    if keys:
        key = keys[0]
    return key
def get_key_id_from_data(module, data):