Upgraded to 1.0.85.3 and the BPA is working now - thanks!. APT was/is complaining about the repo though.

Reading package lists... Done
E: The repository 'https://conversionupdates.paloaltonetworks.com expedition-updates/ Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

I was able to work around it by disabling the checks but that's not ideal.

sudo apt -o Acquire::AllowInsecureRepositories=true \
> -o Acquire::AllowDowngradeToInsecureRepositories=true \
> update