Comment 1 for bug 878481

Checking signatures is intentional, but can't you use debootstrap --no-check-gpg?

Perhaps the real bug here is that germinate-update-metapackage doesn't offer a way to pass either custom options or this particular option through to debootstrap?