My goal is to set up an Ubuntu Server installation via debootstrap from another Ubuntu installation and to be sure that this new installation is a correct Ubuntu installation without modifications. When I execute
debootstrap trusty /mnt http://de.archive.ubuntu.com/ubuntu
I get the response
Valid Release signature (key id 790BC7277767219C42C86F933B4FE6ACC0B21F32)
But how does this release signature is checked? Against what other key? Or to ask in a different kind: How can I be sure that the downloaded package for debootstrap is valid and was not modified on its way?