diff -Nru debian-archive-keyring-2017.7/debian/changelog debian-archive-keyring-2017.7ubuntu1/debian/changelog
--- debian-archive-keyring-2017.7/debian/changelog	2017-12-16 20:11:11.000000000 +0000
+++ debian-archive-keyring-2017.7ubuntu1/debian/changelog	2018-01-16 16:52:37.000000000 +0000
@@ -1,3 +1,12 @@
+debian-archive-keyring (2017.7ubuntu1) bionic; urgency=medium
+
+  * Do not trust debian archive keys by default, and instead ship those
+    keys in usr/share/keyrings. On Ubuntu, this package is mostly used for
+    validating chroots when debootstrapping Debian using
+    /usr/share/keyrings/debian-archive-keyring.gpg
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 16 Jan 2018 16:52:37 +0000
+
 debian-archive-keyring (2017.7) unstable; urgency=medium
 
   * Team upload.
diff -Nru debian-archive-keyring-2017.7/debian/control debian-archive-keyring-2017.7ubuntu1/debian/control
--- debian-archive-keyring-2017.7/debian/control	2017-12-16 20:01:45.000000000 +0000
+++ debian-archive-keyring-2017.7ubuntu1/debian/control	2018-01-16 16:52:37.000000000 +0000
@@ -1,7 +1,8 @@
 Source: debian-archive-keyring
 Priority: important
 Section: misc
-Maintainer: Debian Release Team <packages@release.debian.org>
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+XSBC-Original-Maintainer: Debian Release Team <packages@release.debian.org>
 Build-Depends: debhelper (>= 10), jetring, gnupg
 Rules-Requires-Root: no
 Standards-Version: 4.1.2
diff -Nru debian-archive-keyring-2017.7/debian/debian-archive-keyring.install debian-archive-keyring-2017.7ubuntu1/debian/debian-archive-keyring.install
--- debian-archive-keyring-2017.7/debian/debian-archive-keyring.install	2017-11-23 16:28:46.000000000 +0000
+++ debian-archive-keyring-2017.7ubuntu1/debian/debian-archive-keyring.install	2018-01-16 16:50:54.000000000 +0000
@@ -1,2 +1,2 @@
 usr/share/keyrings/*
-etc/apt/trusted.gpg.d/*
+etc/apt/trusted.gpg.d/* usr/share/keyrings/
diff -Nru debian-archive-keyring-2017.7/debian/debian-archive-keyring.maintscript debian-archive-keyring-2017.7ubuntu1/debian/debian-archive-keyring.maintscript
--- debian-archive-keyring-2017.7/debian/debian-archive-keyring.maintscript	2017-11-23 16:28:46.000000000 +0000
+++ debian-archive-keyring-2017.7ubuntu1/debian/debian-archive-keyring.maintscript	2018-01-16 16:52:24.000000000 +0000
@@ -1,2 +1,10 @@
 rm_conffile /etc/apt/trusted.gpg.d/debian-archive-squeeze-automatic.gpg 2017.5~~
 rm_conffile /etc/apt/trusted.gpg.d/debian-archive-squeeze-stable.gpg 2017.5~~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg 2017.7ubuntu1~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg 2017.7ubuntu1~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg 2017.7ubuntu1~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg 2017.7ubuntu1~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg 2017.7ubuntu1~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg 2017.7ubuntu1~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-wheezy-automatic.gpg 2017.7ubuntu1~
+rm_conffile /etc/apt/trusted.gpg.d/debian-archive-wheezy-stable.gpg 2017.7ubuntu1~