For my systems I rarely take a chance with a third party application even if the packages are signed. Unsigned packages I would not trust . From a security standpoint a unsigned package means that the person who made it may have used a PGP key that is not owned by them. I do not recall the answer for a Debian based system. Here is the link for there Wiki if you like to search and learn more about Debian.

https://wiki.debian.org

If you have deepin 15+, you should not add ubuntu repositories, it is not compatible in most cases. But if you insists, then you need to install from that repository ubuntu-keyring package. But as I say, if you do not have deepin 15+ then is ok to add that repository, because deepin 14 is based on ubuntu. But this you already know, I believe.