Oh yeah the third approach of course is switching defaulting APT::Get::AllowUnauthenticated on by default during the whole initial install process (and possibly thereafter).
I don't know which I dislike more, that option, or the option of not shipping CDs until this is properly fixed.. -- see shy jo
signature.asc
Description: Digital signature