The new FAI release 5.8.7 now supports apt keys in files called package_config/CLASS.gpg. Before we only supported .asc files. fai-mirror has a new option -V, which checks if variables are used in package_config/ and uses variable definitions from class/.var.
I've also created new ISO images, which now install Debian 10 by default. They are available from
https://fai-project.org/fai-cd
If you need a newer kernel, checkout the FAI.me service which can also build ISO images using the kernel from backports which currently is 5.2.