document that security mirrors are only implicitly added if no mirror was specified

mmdebstrap

@@ -2331,23 +2331,25 @@ complex dependencies.
 
 If no I<MIRROR> option is provided, L<http://deb.debian.org/debian> is used,
 except if data was given on standard input in which case the lines read from
-there are used as the content of the chroot's sources.list file. If
+there are used as the content of the chroot's sources.list file. If I<SUITE>
-I<SUITE> is a stable release name, then mirrors for updates and security are
+is a stable release name and no I<MIRROR> is specified, then mirrors for
-automatically added. If a I<MIRROR> option starts with "deb " or "deb-src "
+updates and security are automatically added. If a I<MIRROR> option starts
-then it is used as a one-line-style format entry for apt's sources.list inside
+with "deb " or "deb-src " then it is used as a one-line-style format entry for
-the chroot.  If a I<MIRROR> option contains a "://" then it is interpreted as
+apt's sources.list inside the chroot.  If a I<MIRROR> option contains a "://"
-a mirror URI and the apt line inside the chroot is assembled as "deb [arch=A]
+then it is interpreted as a mirror URI and the apt line inside the chroot is
-B C D" where A is the host's native architecture, B is the I<MIRROR>, C is the
+assembled as "deb [arch=A] B C D" where A is the host's native architecture, B
-given I<SUITE> and D is the components given via B<--components> (defaults to
+is the I<MIRROR>, C is the given I<SUITE> and D is the components given via
-"main"). If a I<MIRROR> option happens to be an existing file, then its
+B<--components> (defaults to "main"). If a I<MIRROR> option happens to be an
-contents are pasted into the chroot's sources.list.  This can be used to
+existing file, then its contents are pasted into the chroot's sources.list.
-supply a deb822 style sources.list. If I<MIRROR> is C<-> then standard input
+This can be used to supply a deb822 style sources.list. If I<MIRROR> is C<->
-is pasted into the chroot's sources.list. If there was data on standard input
+then standard input is pasted into the chroot's sources.list. If there was
-but no C<-> mirror was listed, the lines read from standard input will be
+data on standard input but no C<-> mirror was listed, the lines read from
-appended to the end of the chroot's sources.list. More than one mirror can be
+standard input will be appended to the end of the chroot's sources.list. More
-specified and are appended to the chroot's sources.list in the given order. If
+than one mirror can be specified and are appended to the chroot's sources.list
-any mirror contains a https URI, then the packages apt-transport-https and
+in the given order. If any mirror contains a https URI, then the packages
-ca-certificates will be installed inside the chroot.
+apt-transport-https and ca-certificates will be installed inside the chroot.
+If any mirror contains a tor+xxx URI, then the apt-transport-tor package will
+be installed inside the chroot.
 
 The optional I<TARGET> argument can either be the path to a directory, the
 path to a tarball filename or C<->. If I<TARGET> ends with C<.tar>, or with