These instructions don't match the modern security practices.
apt-key is not used anymore. Instead
- the key file (non-ascii-armored one, but a minimal one, exported with
gpg --export --export-options=export-minimal CA8BB4727A47B4D09B4EE8969386B48A1A693C5C > rocm.gpg) is downloaded and put into a dir within a local filesystem (OTHER THAN /etc/apt/trusted.gpg.d, but any other dir, like /usr/share/keyrings/ or /etc/apt/trusted.gpg.d-3rdp/).
- then the repo is bound to the key file using
signed-by= option
Read https://wiki.debian.org/DebianRepository/UseThirdParty for more info.