Images generated with a few local patches:
 - net-retriever can deal with an archive that has several versions of
   the same package;
 - the apt.debamax.com archive, signed by kibi's key, is trusted;
 - that archive is automatically used when booting from GRUB (UEFI); for
   legacy boots (BIOS), one has to add this on the kernel command line
   manually:
     mirror/udeb/https/hostname=apt.debamax.com
 - that archive ships patched apt-setup udebs that automatically enable
   proposed-updates, so that the patched linux, grub, shim, etc.
   binaries are installed.
 - that archive is otherwise the result of merging udebs from p-u on top
   of buster's, as seen in the Debian archive on 2020-07-29.