I still understand what *package format* related security problem you're referring to. RPM and DEB are equal in that regard. If you choose not to sign your packages, or the user chooses not to validate them (or take into account the results of the validation), then yes, he's exposing himself to a security risk. Whether this happens with RPM or DEB makes no difference whatsoever.

Again, in what way is this different from what debsign does ? In fact a while back uploading to the autobuilder required the package to be signed. I can understand people being more familiar/preferring one package format/manager, but please, please don't dismiss other formats because you're not familiar with them, it really helps no one.