How to locate an URL that serves public GPG key for a package repository?

When I install mysql@5.6 and mysql-client@5.6 in my Debian Jessie docker image with apt-get install -y software-properties-common && \ add-apt-repository 'deb http://archive.ubuntu.com/ubuntu trusty universe' && \ apt-get install -y mysql-server-5.6 mysql-client-5.6 I see the following warning > W: GPG error: http://archive.ubuntu.com trusty Release: The following > signatures couldn't be verified because the public key is not > available: NO_PUBKEY 40976EAF437D05B5 NO_PUBKEY 3B4FE6ACC0B21F32 Not sure if adding keys manually with apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 && \ apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32 is a stable solution. I've read somewhere that GPG keys could be changed when the repository gets updated (please correct me if I am wrong). Also a GPG key could be installed from a package repository URL like this: curl -sL http://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - So I have the following sub-questions there: 1. Do all package repositories that require keys have an URL that serves public GPG keys? 2. Is there any format for such URL?