I'm getting a GPG error"The following signatures were invalid" for apt.progchild.de when reloading the package information in Synaptic.

There is a process for adding the public keys
========= SCRAPER REMOVED AN EMBEDDED LINK HERE ===========
url was:"http://www.progchild.de/debian/"
linktext was:"here"
====================================
- is that what I need to do?

When I add progchild-keyring and try and install it I get a message saying that the package can't be authenticated. Is this okay?

It is a problem with the owner of the apt.progchild.de repo. Nothing we can do and nothing to worry about.
If you don't use goggles music manager you can comment out the repo.

Thanks!