That was actually my (hidden) point.

The dependency hell problems Redhat and early Fedora distributions had, were because there were an official distribution which couldn't take some software because legal issues, and then several 3rd party reposiories which were incompatible with eachothers what it comes to dependencies, library versions and such.

Exactly almost same is now in Maemo repositories the situation. Official brand has done something which the unofficial brand didn't care soon enough, or there were not enough policy to cover the situation.

rpmfusion was founded just to bring finally to end to these disparities of different 3rd party repositories for Fedora, and it has succeeded.

Package format (RPM) never had anything to do about this "dependency hell problem".
Having everything under single one repository (deb) was ofcourse alot of easier then, but nowadays rapid software development needs something else and better co-operation (LSB, OpenDesktop.org, 3rd party packages and repositories)

Practically deb-policy has security problem, because GPG signatures are not embedded and automatically checked, because we know people are lazy and skip this important part of authenticity check if it is much extra work. Right now, the solution would be either to port debsigs-programs to Maemo, or rpm-programs to Maemo and start using it already.