well there is a depends requirement for the torproject.org-keyring package based on https://www.torproject.org/docs/debian recommendations. This package is only in the tor repo. So if it is not added before installing the package, the package will fail. And you can't try to install the torproject.org-keyring package from the postinst script becuase there is a lock on the dpkg already.