Actually, in case of cssu-thumb, it's also matter of merlin's repos being not signed "officially" by certificate acceptable by N900, usually (haven't checked attached logs).
W: GPG error: https://downloads.maemo.nokia.com ./ Release: The following signatures were invalid: KEYEXPIRED 1349249546 KEYEXPIRED 1349249546 KEYEXPIRED 1349249546 W: GPG error: https://downloads.maemo.nokia.com ./ Release: The following signatures were invalid: KEYEXPIRED 1349249546 KEYEXPIRED 1349249546 KEYEXPIRED 1349249546 W: GPG error: https://downloads.maemo.nokia.com ./ Release: The following signatures were invalid: KEYEXPIRED 1349249546 KEYEXPIRED 1349249546 KEYEXPIRED 1349249546 W: You may want to run apt-get update to correct these problems