I was allowed to add an additional vhost to debian.netcologne.de to try out secure apt signature issues. There is now available deb http://testmirror.turmzimmer.net/debian sarge main - the only difference to the real host is an additional signature on http://testmirror.turmzimmer.net/debian/dists/sarge/Release.gpg.

Please feel free to try out that host as mirror for your sarge-based systems, and report any breakages that happen. The second key I used is the volatile archive key (as that was easy available) - I'll switch one day to the real Stable Release Managers key.