Use new trusted.gpg.d keyring for apt key, improve idempotency, only update cache when necessary, only restart service when necessary.