I tried adding it manually and the result is the same:

W: GPG error: http://repository.maemo.org fremantle Release: The following signatures were invalid: BADSIG E40DC434616730BD maemo.org Extras repositories (Fremantle Extras) <repositories@maemo.org>

... help? I've tried rebooting and re-adding the repo, no dice. I have 4 pending updates (glogarchive, gpodder, picodrive and resistance) but I'm kinda paranoid about installing them with a bad signature!

My APT cache is on the MMC, I've added:

dir::cache /home/user/MyDocs/apt-archive-cache;

to /etc/apt/apt.conf, but this was like a week ago and I've updated packages in the time since.