Good call.  How about a -M parameter, which would be "a secondary mirror, often used by distros for retrieving security updates".  Ubuntu would default to using $MIRROR, debian would probably be `http://security.debian.org/`, and Kali would be `http://security.kali.org/kali-security`.