Debian 9 no longer includes the `gnupg` executable, needed for `apt-key add`, in a default debootstrap. As a result, adding of new keys for new repositories silently fails. Thus custom repositories do not have their keys trusted.

Because custom package install happens AFTER repositories are added in chroot-plugin, this cannot be worked around by simply adding gnupg to the install packages list for a defined chroot. gnupg should be added to `extrapackages`, at `--create` time.