I find that hardly unlikely, you can get several .deb files that are most definitely not signed by Debian maintainers, e.g. zoom, all of the packages from . Signatures of packages can be done by anyone, and apt can be configured to accept multiple keys so each distro can choose which ones to accept.

Also, AFAIK, apt only checks signature for packages it itself downloads, which is why you need to add new keys for adding repos but not when installing .deb files. That being said, when I install .deb packages on debian based distros I use dpkg so it might be that apt does check, but you can definitely install deb packages without it.