Building Snapd fails with "E: The repository is not signed."

I’m using snapcraft to build Snapd. I get this error:

+ ./build-from-security.py bionic
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
build-essential is already the newest version (12.9ubuntu3).
build-essential set to manually installed.
0 upgraded, 0 newly installed, 0 to remove and 16 not upgraded.
Get:1 http://archive.ubuntu.com/ubuntu bionic InRelease [242 kB]
Err http://archive.ubuntu.com/ubuntu bionic InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32
Get:2 http://archive.ubuntu.com/ubuntu bionic-security InRelease [88.7 kB]
Err http://archive.ubuntu.com/ubuntu bionic-security InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32
Fetched 331 kB in 0s (0 B/s)
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/apt/cache.py", line 570, in update
    res = self._cache.update(fetch_progress, slist,
apt_pkg.Error: W:Download is performed unsandboxed as root as file '/tmp/aptroot-bioniclinklxyh/var/lib/apt/lists/partial/archive.ubuntu.com_ubuntu_dists_bionic_InRelease' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied), W:GPG error: http://archive.ubuntu.com/ubuntu bionic InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32, E:The repository 'http://archive.ubuntu.com/ubuntu bionic InRelease' is not signed., W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:GPG error: http://archive.ubuntu.com/ubuntu bionic-security InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32, E:The repository 'http://archive.ubuntu.com/ubuntu bionic-security InRelease' is not signed.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/root/parts/fontconfig-bionic/build/./build-from-security.py", line 97, in <module>
    build_freetype(release)
  File "/root/parts/fontconfig-bionic/build/./build-from-security.py", line 59, in build_freetype
    pkgbasesrcdir = fetch_source_from_security(release, "libfreetype6-dev")
  File "/root/parts/fontconfig-bionic/build/./build-from-security.py", line 40, in fetch_source_from_security
    cache.update(apt.progress.text.AcquireProgress())
  File "/usr/lib/python3/dist-packages/apt/cache.py", line 573, in update
    raise FetchFailedException(e)
apt.cache.FetchFailedException: W:Download is performed unsandboxed as root as file '/tmp/aptroot-bioniclinklxyh/var/lib/apt/lists/partial/archive.ubuntu.com_ubuntu_dists
_bionic_InRelease' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied), W:GPG error: http://archive.ubuntu.com/ubuntu bionic InRelease: The fol
lowing signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32, E:The repository 'http://archive.ubuntu.com/ubuntu bionic InRelease' is not signed., W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:GPG error: http://archive.ubuntu.com/ubuntu bionic-security InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3B4FE6ACC0B21F32, E:The repository 'http://archive.ubuntu.com/ubuntu bionic-security InRelease' is not signed.
Failed to run 'override-build': Exit code was 1.

I tried to to add

  gpg --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32

in the override step but it was none the better. Any idea how to solve this?