Since the keys for packages.ros.org work as expected one can remove snapshot.ros.org and use packages.ros.org (see here) as a workaround until the key issue is fixed. This at least fixes my CI build for the time beeing. 
e.g. like this:
FROM ros:galactic
RUN rm /etc/apt/sources.list.d/ros2-snapshots.list
RUN apt update && apt install curl
RUN curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
RUN echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null