Remote not signed

Version
From pulp status:

      "versions": {
        "deb": "3.10.0",
        "gem": "0.8.0",
        "npm": "0.9.0",
        "rpm": "3.38.4",
        "core": "3.114.2",
        "file": "3.114.2",
        "maven": "0.25.1",
        "ostree": "2.6.1",
        "python": "3.32.1",
        "ansible": "0.30.0",
        "certguard": "3.114.2",
        "container": "2.28.1",
        "hugging_face": "0.3.0"
      }

Describe the bug
I followed the quick start instructions using Docker to setup a test installation and then the "Repository Synchronization" chapter to create an on-demand remote for the upstream Debian APT repository, using these commands:

export NAME=debian
pulp deb remote create \
  --name ${NAME} \
  --url https://deb.debian.org/debian \
  --proxy-url ${PROXY_URL} \
  --policy on_demand \
  --component '' \
  --architecture all \
  --architecture amd64 \
  --architecture arm64 \
  --distribution trixie \
  --distribution trixie-updates \
  --distribution trixie-backports
pulp deb repository create --name=${NAME} --remote=${NAME}
pulp deb repository sync --name=${NAME}
pulp deb publication create --repository=${NAME}
pulp deb distribution create --name=${NAME} --base-path=${NAME} --repository=${NAME}

But when running apt-get update after replacing the upstream repository URL in /etc/apt/sources.list.d/debian.sources with the one found in the output of the last command, I got the following error messages:

E: The repository 'http://<hostname redacted>:8080/pulp/content/debian trixie Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

To Reproduce

1. Replace URI in /etc/apt/sources.list.d/debian.sources with the one found in the output of the last command
2. Run apt-get update

Expected behavior
Package lists should have been updated from the Pulp repository with no error.

Reproduce the issue with the listed pulp deb remote, repository sync, publication, and distribution commands, then run apt-get update against the generated URL. Trace how the Debian publication is served and whether its Release metadata is signed. Done means apt accepts the Pulp repository and updates its package lists without the unsigned-repository error.