On Sun, Dec 18, 2016 at 12:35 PM, datanoise <datanoise@bitjungle.info> wrote: > There could be https mirrors as well as non-https mirrors. There is https://cloudfront.debian.net which you could decide to trust. It doesn't *need* to be a "Debian SSL cert"; since you trust the mirror anyway is some regard, you could as well "just" also trust the mirror's certificate (and handling thereof). Kindly, -- Casper Thomsen