It looks like the Win2016 image has a powershell version whose default TLS settings are no longer sufficient for downloading stuff from Microsoft. Maybe this can also be fixed by downloading a newer installer ISO version, but I couldn't figure out where to get the most up-to-date image from.
https://rnelson0.com/2018/05/17/powershell-in-a-post-tls1-1-world/
It looks like the Win2016 image has a powershell version whose default TLS settings are no longer sufficient for downloading stuff from Microsoft. Maybe this can also be fixed by downloading a newer installer ISO version, but I couldn't figure out where to get the most up-to-date image from.