The deb files can be downloaded directly from the release archive and they can be installed via dpkg -i
The other other workaround would be to explicitly trust the 4.0 repo, do this only on the 4.0 repo(or other unsupported / expired repo key) if you choose to use this option.
Add the trusted=yes option to the repo definition, read man 5 sources.list to understand this option and its implications.
echo "deb [ arch=amd64,arm64 trusted=yes ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.0 multiverse" > /etc/apt/sources.list.d/mongodb-org-4.0.list