def __update_in_toto_layout_pubkeys(self):
        '''
        NOTE: We assume that all the public keys needed to verify any in-toto
        root layout, or sublayout, metadata file has been directly signed by
        the top-level TUF targets role using *OFFLINE* keys. This is a
        reasonable assumption, as TUF does not offer meaningful security
        guarantees if _ALL_ targets were signed using _online_ keys.
        '''

        target_relpaths = []
        targets = self.__updater.targets_of_role('targets')

        for target in targets:
            target_relpath = target['filepath']

            # Download this target only if it _looks_ like a public key.
            if target_relpath.endswith('.pub'):
                # NOTE: Avoid recursively downloading in-toto metadata for
                # in-toto root layout pubkeys themselves, and so on ad
                # infinitum.
                self.__get_target(target_relpath, download_in_toto_metadata=False)
                target_relpaths.append(target_relpath)

        return target_relpaths