Aptitude thinks all packages are untrusted

[Michael Torrie]

I'm getting Debian 5.0 Lenny up and running on my plug computer
(currently via an NFS root).  I believe I'm using the armel
architecture.  Aptitude is complaining that all packages I try to
install are untrusted.  I've done quite a bit of research online and
have followed the instructions to make sure I have the proper gpg keys
installed into apt.  In fact, apt-key list shows I have keys for:

 - Etch Stable Release Key <debian-release at lists.debian.org>
 - Debian-Volatile Archive Automatic Signing Key (expired: 2010-03-30)
 - Lenny Stable Release Key <debian-release at lists.debian.org>
 - Debian Archive Automatic Signing Key (5.0/lenny)
 - Debian-Volatile Archive Automatic Signing Key (5.0/lenny)
 - a key for Martin Michlmayr (????)

I also have the proper debian-keyring and debian-archive-keyring
packages installed, and gnupg.

No matter what I do I cannot seem to get apt or aptitude to trust/verify
the packages that are coming from official debian sources (have checked
against the primary mirror), and packages I am pretty sure are signed by
the debian maintainers.

Can anyone point me in the right direction here?

thanks.

Michael