security bug: Debian apt repos are updated without users' knowledge or consent, daily

The package installer creates /etc/cron.daily/keybase, which then creates /etc/apt/sources.list.d/keybase.list and installs a signing key without asking the user to consent, and without informing them that it was done. This action is also undocumented. And it runs daily!

presumption of trust
The installer makes the invalid assumption that because a user has opted to trust one version of one tool, that the user therefore automatically trusts all versions of all keybase tools going forward.

unchecked silent auto updates
The stock Debian installation now defaults to having an auto-update mechanism that installs security-critical updates. Keybase can leverage that mechanism to inject malware without the user even knowing that an update occurred. Apart from that, silent updates can also reverse security hardening that the user has added (see https://github.com/keybase/client/issues/9757). Users don't even know that trust is broadly extended to the keybase repository, which is the next problem:

deception
The user is not informed that keybase was added to the sources.list. So when apt commands like aptitude show keybase actually present useful output, it misleads the user into believing that the keybase project has been accepted into official Debian repositories. Debian users are generally aware that the Debian project has quality standards and that an official Debian developer must endorse the code. So this deception fools users into thinking that keybase has satisfied that standard.

forced acceptance
When a user discovers that keybase has approved its own repo on behalf of the user, and consequently removes the sources.list file to revoke the trust that wasn't given in the first place, their action will be reversed silently within a day because the daily cronjob is where the repos are manipulated -- which is quite inappropriate and borderline malicious intent IMO. It abuses the users' trust. What could possibly be the legitimate rationale for daily enforcement of repository trust?

non-standard practice
The standard practice for unofficial apps is for new users to have a choice: they can install a one-off .deb file, or they can update their sources.list, depending on the level of trust they want to extend to the developers and whether they want future updates, or whether they're doing a temporary one-off trial that they want to be easily removable. Users who extend their sources.list are to an acceptable extent giving their informed consent for that action.

The end-game should be to get the package in the official Debian repository. Until then, users should not be blind-sided by shenanigans.

Start by tracing the Debian package installer and the /etc/cron.daily/keybase job described in the report, including its creation of /etc/apt/sources.list.d/keybase.list and the signing key. Review the unresolved comment discussion before proceeding. Done means repository changes are no longer silently enforced and the user is informed or given consent for the trust and update behavior.