.deb package signed with a deprecated SHA1 algorithm

When following the guide to verify the signature for the .deb package, I got the following error:

$ debsig-verify --debug gcm.deb

debsig: Starting verification for: gcm.deb
debsig:         getSigKeyID: got 189ABF20BC4D22098078A6403C853823978B07FA for origin key
debsig: getDbPathname: using /etc/debsig/policies/3C853823978B07FA keyring
debsig: Using policy directory: /etc/debsig/policies/3C853823978B07FA
debsig:   Parsing policy file: /etc/debsig/policies/3C853823978B07FA/generic.pol
debsig:     parsePolicyFile: parsing '/etc/debsig/policies/3C853823978B07FA/generic.pol'
debsig:     parsePolicyFile: completed
debsig:     Checking Selection group(s).
debsig:       Processing 'origin' key...
debsig: getDbPathname: using /usr/share/debsig/keyrings/3C853823978B07FA/gcm-public.gpg keyring
debsig:         getKeyID: mapped 3C853823978B07FA -> 189ABF20BC4D22098078A6403C853823978B07FA
debsig:         getSigKeyID: got 189ABF20BC4D22098078A6403C853823978B07FA for origin key
debsig:     Selection group(s) passed, policy is usable.
debsig: Using policy file: /etc/debsig/policies/3C853823978B07FA/generic.pol
debsig:     Checking Verification group(s).
debsig:       Processing 'origin' key...
debsig: getDbPathname: using /usr/share/debsig/keyrings/3C853823978B07FA/gcm-public.gpg keyring
debsig:         getKeyID: mapped 3C853823978B07FA -> 189ABF20BC4D22098078A6403C853823978B07FA
debsig:         getSigKeyID: got 189ABF20BC4D22098078A6403C853823978B07FA for origin key
gpg: Signature made Wed 30 Oct 2024 11:59:51 CET
gpg:                using RSA key 189ABF20BC4D22098078A6403C853823978B07FA
gpg: Note: signatures using the SHA1 algorithm are rejected
gpg: Can't check signature: Invalid digest algorithm
debsig: sigVerify: gpg exited abnormally or with non-zero exit status
debsig: verifyGroupRules: failed for origin
debsig:     Verification group failed checks.
debsig: Failed verification for gcm.deb.

I believe that the failure is due to "signatures using the SHA1 algorithm are rejected". Would it be possible to sign the package using a modern algorithm instead?

Start with docs/linux-validate-gpg.md#debian-package and reproduce the failure using debsig-verify --debug gcm.deb. Check how the published .deb is signed; done means debsig-verify accepts it without rejecting a SHA1 signature.