I wasn't able to determine from the debmirror(1) man page the extent to
which content is verified.  It states that the top level Release file is
verified by its PGP signature, but doesn't mention whether further downloaded
content is verified against this anchor.  Looking at the dependencies on various
hashing libraries, I'm guessing it does, but it would be good to state this
explicitly.

I'd also be interested in a brief description of what happens if a downloaded
file doesn't match.  I think users of this program would be interested to know
if it's possible for unverified content to end up in the target directory, or
whether the verification is done before putting the content in place.

I'd also be interested whether the condition of having downloaded content that
failed verification is detectable by debmirror's exit code.