That's only for the mirrors which have a shared debian.org hostname. If you use e.g. mirrorbrain it'll redirect to the closest mirror. Based upon https://www.d

That's only for the mirrors which have a shared debian.org hostname. If you use e.g. mirrorbrain it'll redirect to the closest mirror. Based upon https://www.debian.org/mirror/list https://www.debian.org/mirror/list, it seems they all have pretty much unique hostnames (ftp.<COUNTRY>.debian.org). You can easily get a certificate for that. In brief: It's not a huge issue to get a certificate.