The documentation to achieve this is somewhat hard to find, since it is mostly a pulp_deb and not a Foreman/Katello feature that you need to set up. What you need to do is create a “AptReleaseSigningService” directly within Pulp, and it must be named “katello_deb_sign” (so that Katello will find and use it).
The documentation for how to create an “AptReleaseSigningService” within Pulp can be found here:
https://docs.pulpproject.org/pulp_deb/workflows/signing_service.html
Just remember to adjust the name from the example to “katello_deb_sign”, and Katello will automatically start using it for all your APT repos. Note that all your APT (deb type) repos in Katello will use the signing service if it exists.