APEX files are apparently signed with test keys on LineageOS 19.1 and above

Unsigned lineage-21.0 builds for lilac (Xperia XZ1 Compact) are working for me, but builds signed with my own keys get stuck in a boot loop.

It looks to me like this is caused by at least three bad apex signatures.

Here's the relevant dmesg output, retrieved from /sys/fs/pstore/console-ramoops-0:

[    2.885986] apexd-bootstrap: Found 16 idle loopback devices that were pre-allocated by kernel. Allocated 20 more.
[    2.960938] apexd-bootstrap: Failed to read /sys/class/block/sda/mq/0/nr_tags: No such file or directory
[    3.001265] apexd-bootstrap: Failed to read /sys/class/block/sda/mq/0/nr_tags: No such file or directory
[    3.013524] apexd-bootstrap: Failed to activate /system/apex/com.android.i18n.apex(com.android.i18n@1): Failed to verify Apex Verity data for /system/apex/com.android.i18n.apex: Error verifying /system/apex/com.android.i18n.apex : public key doesn't match the pre-installed one
[    3.013540] apexd-bootstrap: Failed to activate /system/apex/com.android.runtime.apex(com.android.runtime@1): Failed to verify Apex Verity data for /system/apex/com.android.runtime.apex: Error verifying /system/apex/com.android.runtime.apex : public key doesn't match the pre-installed one
[    3.021042] apexd-bootstrap: Failed to read /sys/class/block/sda/mq/0/nr_tags: No such file or directory
[    3.036826] apexd-bootstrap: Failed to activate /system/apex/com.android.tzdata.apex(com.android.tzdata@350090000): Failed to verify Apex Verity data for /system/apex/com.android.tzdata.apex: Error verifying /system/apex/com.android.tzdata.apex : public key doesn't match the pre-installed one
[    3.036881] apexd-bootstrap: Failed to activate bootstrap apex files : Failed to activate 3 APEX packages. One of the errors: Failed to activate /system/apex/com.android.i18n.apex(com.android.i18n@1): Failed to verify Apex Verity data for /system/apex/com.android.i18n.apex: Error verifying /system/apex/com.android.i18n.apex : public key doesn't match the pre-installed one
[    3.037977] init: Service 'apexd-bootstrap' (pid 594) exited with status 1 waiting took 0.505000 seconds
[    3.037994] init: Sending signal 9 to service 'apexd-bootstrap' (pid 594) process group...
[    3.038139] libprocessgroup: Removed cgroup /sys/fs/cgroup/uid_0/pid_594
[    3.038158] init: Service apexd-bootstrap has 'reboot_on_failure' option and failed, shutting down system.

...generated as described in the LineageOS Signing Builds instructions. Note that keys were generated for the apex files that fail to verify.

Is something missing or out of date in the signing stage of the docker image scripts?