[gurrone]

Also an interesting option is using deb822 sources.list format and inline the key https://lists.debian.org/debian-devel/2021/11/msg00026.html

Still a bit ugly depending on the point of view you take but a 3rd party vendor can just tell the user to download this file and store it in /etc/apt/sources.list.d/ which should make that whole thing a bit more frictionless.