Package managers such as
aptitude which is used on Debian implement GPG keys to authenticate the package. The Debian install will come with the public key of the package signer, which is then checked before installing downloaded packages.
Sometimes you'll find you end up with an error if this process fails:
W: GPG error: http://www.debian-multimedia.org etch Release: The following signatures couldn't be verified because teh public key is not available: NO_PUBKEY 07DC563D1F41B907
W: You may want to run apt-get update to correct these problems
You can see more details about the solution, called SecureApt, here: https://wiki.debian.org/SecureApt
To address your revision regarding the downloading of installer CD images:
Yes, multiple mirrors exist and one of the primary delivery methods (HTTP) is vulnerable to a MITM attack which could modify the image in such a way as to make your installer contain a rootkit. However, unlike updating packages, installing the base system is a much less frequent event.
Manual PGP protections are also in place for the CD images. Firstly, all disc images on the mirrors should provide MD5 and multiple SHA hashes for every image. These hash files are themselves signed by Debian to ensure they also cannot be forged on a mirror site.
Before downloading the ISO, verify the integrity of the SHA256 or SHA512 (most secure) using for example
gpg --verify SHA512SUMS.sign SHA512SUMS
This will give you an error if you don't currently have the public key the file was signed with. In that case check the signature given and compare it against the trusted keys on Debian's website: http://www.debian.org/CD/verify
This is the most important part of verification, because integrity of the hash file revolves around the integrity of the key you trust.
Once you've verified an appropriate key, install it in your keychain like so:
gpg --recv-key --keyserver subkeys.pgp.net LAST8CHARSOFFINGERPRINT. This
fetches a key matching the signing key's fingerprint from a server.
gpg --verify SHA512SUMS.sign SHA512SUMS should now tell you whether the hash file is authentic. If it is, you can safely compare the result of your
sha512 chosen.iso with what's in the sums file.
Naturally this all assumes you run these commands from a trusted computer, where
gpg are unaltered by an attacker.
YPMV (your paranoia may vary).