For those of you not familiar, apt-cacher-ultra is fairly new (~9 months old), and it can reduce your exposure to this. It uses a completely different mechanism for verifying signatures, and does validate signatures, so if your apt clients grab the packages from the cache, it shouldn't be open to this bug.

The next version is going to include TLS and ACME support for the client->cache connection.

https://github.com/linsomniac/apt-cacher-ultra