“must run as root” App.deb

Yeah. That’s how you install ad-hoc packages where the author didn’t put them properly in a repo with signatures.

But, as Debian has impaired validation anyway - it’s a package format thing - it’s not AS big a deal.