For CDs there is the checksum file and a signature file, one example is https://mirrors.kernel.org/debian-cd/current/amd64/iso-cd/SHA256SUMS and https://mirrors.kernel.org/debian-cd/current/amd64/iso-cd/SHA256SUMS.sign.
For net installers, there is a checksum file https://mirrors.kernel.org/debian/dists/wheezy/main/installer-amd64/current/images/SHA256SUMS but there is no matching https://mirrors.kernel.org/debian/dists/wheezy/main/installer-amd64/current/images/SHA256SUMS.sign . This is also true for versions other than wheezy. Are the signatures somewhere else, and if not where should a bug be filed? Thanks, Sarah
