Looks like somebody either made a boo boo and updated the official Google Chrome Debian repository with an expired GPG key .. or it's an attack with a compromised, old key ..
Luckily, Google has excellent feedback mechanisms where I could escalate this to almost immedi ... oh, wait
It's a little baffling to me .. you'd think they had some user journey tests to cover this rather trivial issue ..