On both Debian 9.4 and Ubuntu 16.04 (what I have handy):

  # Do not enable debsig-verify by default; since the distribution is not using
  # embedded signatures, debsig-verify would reject all packages.
  no-debsig