### Summary

Based on feedback from a mastodon ansible user:

The first example of https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#examples (the apt_key replacement) shows how a pgp key is downloaded and declared as trusted for a repository, but there is no validation of the key going on. Maybe the get_url task could include the checksum argument, to show that (and how) the key should be validated against a known good. Further down there is also an example of apt_key downloading a key without the id argument specified.

### Issue Type

Documentation Report

### Component Name

apt_key

### Ansible Version

```console
$ ansible --version
2.15
```


### Configuration

```console
# if using a version older than ansible-core 2.12 you should omit the '-t all'
$ ansible-config dump --only-changed -t all
none
```


### OS / Environment

none

### Additional Information

The examples all use https URLs, so they do not expose you to just arbitrary MITM; but many projects use untrusted public mirrors to distribute packages and public keys, and instead post the fingerprint of the public key on the non-mirrored first-party website. You are then supposed to verify the downloaded key against that fingerprint (unfortunately a manual action since they post a PGP fingerprint and not a checksum), in order to protect against rogue mirror operators (AFAIK).

### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct
- The keyserver to retrieve key from.
        type: str
        version_added: "1.6"
    state:
        description:
            - Ensures that the key is present (added) or absent (revoked).
        type: str
        choices: [ absent, present ]
        default: present
    validate_certs:
        description:
            - If C(false), SSL certificates for the target url will not be validated. This should only be used
              on personally controlled sites using self-signed certificates.
        type: bool
        default: 'yes'
'''
EXAMPLES = '''
- name: One way to avoid apt_key once it is removed from your distro, armored keys should use .asc extension, binary should use .gpg
  block:
    - name: somerepo | no apt key
      ansible.builtin.get_url:
        url: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x36a1d7869245c8950f966e92d8576a8ba88d21e9
        dest: /etc/apt/keyrings/myrepo.asc
    - name: somerepo | apt source
      ansible.builtin.apt_repository:
        repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/myrepo.asc] https://download.example.com/linux/ubuntu {{ ansible_distribution_release }} stable"
        state: present
- name: Add an apt key by id from a keyserver
  ansible.builtin.apt_key:
    keyserver: keyserver.ubuntu.com