Missing GnuPG signatures for checksums

[Laurențiu Păncescu <lpancescu@gmail.com>]

Hello,

I'm trying to put a preseed file on the same USB stick as the 
installation, using hd-media/boot.img.gz is easier than remastering the 
iso. It works, but there seems not to be any signed checksum file for 
these images and they are served only over http:

http://http.us.debian.org/debian/dists/buster/main/installer-amd64/current/images/

How can I check if these images are authentic? I guess I could mount a 
signed CD iso like netinst, copy vmlinuz and initrd from there and 
create my own USB stick with syslinux - is there a better way?

Thanks in advance,
Laurențiu