I moved my arch installed to systemd-boot.

I've gone an entire year without updating one of my test servers, and months on other test machines.

My go-to is always the same and has worked everytime - Update the keyring package alone prior to any other updates. Flawless.