Packages.microsoft.com is reachable over https. There is also a gpg key that can be imported. The person who put this image together chose not to use either.

https://docs.microsoft.com/en-us/windows-server/administrati...