Bug#432309: debootstrap should use signed Release files

[Christoph Anton Mitterer <christoph.mitterer.ext@siemens.com>]

Hi Frans.

That happens when I make long lists with headwords about possible bugs/enhancements that i finally submit all at one rainy day like today *G*
After having a closer look at debootstrap again I remember what I really wanted to suggest *G*:

- I think it would be an improvement if debootstrap would per default use the standard debian-archive-keyring for validating the Release files. It still could allow to select another or disable checking at all (via a new option), thus:
- debootstrap should depend on or at least recommend debian-archive-keyring

Best wishes,
Chris.

btw: What's the reason to keep both debootstrap and cdebootstrap in debian? They seem to be very similar.