Debian's Apt Affected by MitM Attack for Arbitrary Code Execution as Root

"Don't worry, emudhra is not bad, we have package signing" - Ubuntu

What's the fallback after both signing and https are broken?