Actually does Whonix host have to include whonix apt sources?
Why not include the relevant Whonix packages in Debian servers, as done with all the other packages?
Advantages:
No obvious connection to Whonix servers (if updating with clearnet, or visible to exit node if going through Tor).
Not relying on the security level of whonix servers (secured to the same level as debian servers?)