It used to be that the kernel in main/installer-amd64 was unsigned, which is why my scripts had to go look in main/signed instead. Apparently this changed at some point, which announcement I missed, and as you say the kernel that is stored together with the netboot image is now signed. I am happy, as a fair bunch of bespoke logic to figure out the correct kernel can now be shown the door, and the script becomes significantly simpler. But, I should have checked this beforehand with sbverify. Mea culpa indeed. Sorry for the hassle.
It used to be that the kernel in main/installer- amd64 was unsigned, which is why my scripts had to go look in main/signed instead. Apparently this changed at some point, which announcement I missed, and as you say the kernel that is stored together with the netboot image is now signed. I am happy, as a fair bunch of bespoke logic to figure out the correct kernel can now be shown the door, and the script becomes significantly simpler. But, I should have checked this beforehand with sbverify. Mea culpa indeed. Sorry for the hassle.