On a Debian Stretch server, APT ist configured via /etc/apt/apt.conf.d/10periodic
to automatically update itself every day.
Hadn't I run "apt-get update" manually by chance, I wouldn't have noticed this error:
W: Failed to fetch https://packages.sury.org/php/dists/stretch/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B188E2B695BD4743
I downloaded the updated GPG key to fix the problem, but I need a way to be informed by APT when things go wrong. The server was missing two PHP updates because of this.
https://wiki.debian.org/UnattendedUpgrades mentions "APT::Periodic::Verbose", but this doesn't allow to only be notified about errors (and I really don't need a mail from all 50 servers every day...)
edit 2019-05-13: The package unattended-upgrades is not installed, and I don't want to use it. APT should only update itself, not upgrade.