Debian 8.3, LXC 1:1.0.6-6+deb8u2
When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the checksum of the downloaded file (and also that the signature itself is valid) as described here. Apt also verifies packages automatically. Does the following LXC command download the base packages 'outside' of the apt system, making LXC a security weakness to the host with LXC installed?
lxc-create -n mycontainer -t debian