### Summary

Based on feedback from a mastodon ansible user:

The first example of https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#examples (the apt_key replacement) shows how a pgp key is downloaded and declared as trusted for a repository, but there is no validation of the key going on. Maybe the get_url task could include the checksum argument, to show that (and how) the key should be validated against a known good. Further down there is also an example of apt_key downloading a key without the id argument specified.

### Issue Type

Documentation Report

### Component Name

apt_key

### Ansible Version

```console
$ ansible --version
2.15
```


### Configuration

```console
# if using a version older than ansible-core 2.12 you should omit the '-t all'
$ ansible-config dump --only-changed -t all
none
```


### OS / Environment

none

### Additional Information

The examples all use https URLs, so they do not expose you to just arbitrary MITM; but many projects use untrusted public mirrors to distribute packages and public keys, and instead post the fingerprint of the public key on the non-mirrored first-party website. You are then supposed to verify the downloaded key against that fingerprint (unfortunately a manual action since they post a PGP fingerprint and not a checksum), in order to protect against rogue mirror operators (AFAIK).

### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct
"""validate the key_id and break it into segments
    :arg key_id: The key_id as supplied by the user.  A valid key_id will be
        8, 16, or more hexadecimal chars with an optional leading ``0x``.
    :returns: The portion of key_id suitable for apt-key del, the portion
        suitable for comparisons with --list-public-keys, and the portion that
        can be used with --recv-key.  If key_id is long enough, these will be
        the last 8 characters of key_id, the last 16 characters, and all of
        key_id.  If key_id is not long enough, some of the values will be the
        same.
    * apt-key del <= 1.10 has a bug with key_id != 8 chars
    * apt-key adv --list-public-keys prints 16 chars
    * apt-key adv --recv-key can take more chars
    """
    
    int(to_native(key_id), 16)
    key_id = key_id.upper()
    if key_id.startswith('0X'):
        key_id = key_id[2:]
    key_id_len = len(key_id)
    if (key_id_len != 8 and key_id_len != 16) and key_id_len <= 16:
        raise ValueError('key_id must be 8, 16, or 16+ hexadecimal characters in length')
    short_key_id = key_id[-8:]
    fingerprint = key_id
    if key_id_len > 16:
        fingerprint = key_id[-16:]
    return short_key_id, fingerprint, key_id
def parse_output_for_keys(output, short_format=False):