work properly because it doesn't allow for signing key configuration.
Rename it to the more domain-specific EXTRA_PPAS (which is now a
space-separated sequence of <ppa-owner>/<ppa-name> pairs), and fetch
signing keys for those from Launchpad using python3-software-properties.
