I noticed this earlier today in Lucid but got busy. Now I'm modifying my chroot script and mounted Karmic:
W: GPG error: http://downloads.sourceforge.net all Release: The following signatures were invalid: BADSIG CCC158AFC1289A29 Daniel Folkinshteyn (Ubuntuzilla signing key) <nanotube@users.sourceforge.net>
BTW the update to FF 3.6 continues fine anyway:
Install these packages without verification [y/N]? y