> Their signed package formats (there are two) add extra sections to the `ar` archive for the signature

APT does not verify package-level signatures (and nobody uses them anyway), so this is irrelevant.