W: ... Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg) is a warning, not an error: in the test apt-get update still read the repository and returned 0. In this test it appeared after the key was added with apt-key add. To clear it, keep the key in its own file under /etc/apt/keyrings and name that file in the repository line with signed-by=.

In the test, moving /etc/apt/trusted.gpg aside and restoring signed-by=/etc/apt/keyrings/docker.asc on the line gave an update with no warning and the Docker feed still read.

The error

$ echo "deb [arch=amd64] https://download.docker.com/linux/ubuntu noble stable" > /etc/apt/sources.list.d/docker.list
exit code: 0
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
OK
exit code: 0
$ apt-get update
Hit:1 https://download.docker.com/linux/ubuntu noble InRelease
Hit:2 http://archive.ubuntu.com/ubuntu noble InRelease
...
Reading package lists...
W: https://download.docker.com/linux/ubuntu/dists/noble/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
exit code: 0

Why it happens

apt-key add still works on Ubuntu 24.04, and it says it is deprecated as soon as you run it. It wrote the Docker key into the shared file /etc/apt/trusted.gpg. The repository line had no signed-by=, so apt verified the feed with that shared file, accepted it (Hit:1), and then warned that the key sits in the legacy keyring. Nothing failed, which is why the exit code was 0; the warning is a notice to move the key.

The fix

The key file /etc/apt/keyrings/docker.asc already existed from the earlier step (downloaded with curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc). The legacy keyring was moved aside, not deleted, and the line got its signed-by= back: 

$ ls -l /etc/apt/trusted.gpg
-rw-r--r-- 1 root root 2760 Nov 13 05:20 /etc/apt/trusted.gpg
exit code: 0
$ mv /etc/apt/trusted.gpg /root/trusted.gpg.old
exit code: 0
$ echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable" > /etc/apt/sources.list.d/docker.list
exit code: 0
$ apt-get update
Hit:1 https://download.docker.com/linux/ubuntu noble InRelease
Hit:2 http://security.ubuntu.com/ubuntu noble-security InRelease
Hit:3 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:4 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:5 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Reading package lists...
exit code: 0

The Docker feed still showed Hit:1 and the W: line was gone. In this container /etc/apt/trusted.gpg held the Docker key alone (gpg --no-default-keyring --keyring /root/trusted.gpg.old --list-keys listed one key, Docker Release (CE deb)), so moving the whole file was safe here. List the keys in your own file the same way before you move it, and run apt-get update afterwards to check.

How it was reproduced

The capture was made in an ubuntu:24.04 container (Ubuntu 24.04.5 LTS, apt 2.8.3, gnupg 2.4.4) on Docker Engine 29.9.3, standing in for Ubuntu in WSL. As root, Docker's key was first saved to /etc/apt/keyrings/docker.asc with a signed-by= line, then the line was rewritten without that option and the same key was piped into apt-key add -; last, the legacy file was moved aside and signed-by= restored. An update ran after each step.

Frequently asked

Is 'Key is stored in legacy trusted.gpg keyring' an error?
No. It is a W: line. In the test apt-get update read the repository and returned exit code 0 while printing it.
Is apt-key deprecated on Ubuntu 24.04?
It still ran in the test, but it printed: Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead.
How do I add a repository key without apt-key?
Save the key file under /etc/apt/keyrings and add signed-by= with that path to the repository line. In the test that setup updated with no warning.

More decoded errors in the Fixes category. If no key was added at all, apt fails instead of warning; see NO_PUBKEY, the public key is not available.