Hi, apg is dead upstream. We can either pull the package (forcing people back to pwgen, which probably has comparable issues) or document the issues away.
Would you want to provide wording for a README.Debian or an addition to the package description? For bullseye, "pull package" is the only viable solution now. Greetings Marc