Improve key fetching and validation in script

Enhance key fetching logic with additional validation checks.

ubuntu-to-mint-convert-v3.sh

@@ -309,10 +309,24 @@ mint_repo_key_write_to() {
     || die "Unable to fetch Mint repo key via keyserver or HTTPS fallback."
 fi
 
-    # Basic safety check: ensure the fetched key contains the expected key id (last 16 hex of fingerprint)
-    local fpr_last16
-    fpr_last16="$(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="fpr"{print $10}' | tail -n1 | tail -c 17 | tr -d '\n' | tr '[:lower:]' '[:upper:]')"
-    [[ "$fpr_last16" == "${keyid^^}" ]] || die "Fetched key fingerprint suffix mismatch (expected ${keyid^^}, got ${fpr_last16:-<none>})."
+# Sanity: ensure it's a PGP public key block
+grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$armored" || die "Downloaded key is not a PGP public key block (proxy portal/HTML?)"
+
+# Validate: the expected keyid appears in the key block (pub OR sub)
+local found="no"
+while IFS= read -r kid; do
+  if [[ "${kid^^}" == "${keyid^^}" ]]; then
+    found="yes"
+    break
+  fi
+done < <(gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="pub"||$1=="sub"{print $5}')
+
+[[ "$found" == "yes" ]] || die "Fetched key does not contain expected keyid ${keyid^^}"
+
+# (Optional) extra guard: make sure the UID looks like Linux Mint repo key
+if ! gpg --batch --with-colons --show-keys "$armored" | awk -F: '$1=="uid"{print $10}' | grep -qi "Linux Mint Repository Signing Key"; then
+  warn "Keyid matched but UID did not match expected Mint repo UID; review /tmp key block if concerned."
+fi
 
 gpg --batch --dearmor -o "$out_keyring" "$armored"
 chmod 644 "$out_keyring"