where to find secure download of installer kernel

[Sam Overton <samoverton+d-b@gmail.com>]

Hi,

I'm trying to download a copy of vmlinuz and initrd.gz from

${MIRROR}/debian/dists/stretch/main/installer-amd64/current/images/hd-media/

All Debian mirrors appear to be HTTP only, and since these files are not deb packages, there is no GPG signing of the files. The mirror contains checksums, but these are also served over insecure HTTP.

What is the secure way to download and verify these files?

Thanks in advance,

Sam Overton