Hi, I'm trying to download a copy of vmlinuz and initrd.gz from
${MIRROR}/debian/dists/stretch/main/installer-amd64/current/images/hd-media/
All Debian mirrors appear to be HTTP only, and since these files are not
deb packages, there is no GPG signing of the files. The mirror contains
checksums, but these are also served over insecure HTTP.
What is the secure way to download and verify these files?
Thanks in advance,
Sam Overton
