Web lists-archives.com

Re: Faulty .iso? No public key...

What does "apt policy debian-archive-keyring" show? Which version (if
any) do you have installed?

You could also try "apt install debian-archive-keyring"

This should clear up the issues with stretch-updates, but not the
virtualbox repository. For that you'll need to find, verify and import
the relevant key for that repository to get apt to accept it.

Note that virtualbox is available from Debian itself in stretch-