The code had two problems:

 - For the "torproject" archive, it was checking the "stable" suite,
   which we don't track anymore.

 - For the "debian-security" archive, it was checking the stretch/updates
   suite, which we don't track anymore.

… both spotted by kibi during the 4.2 release process.