A protocol should definitely be in place for that, all the updates I do are handled just by using apt-get except for certificates. Like I don't want to handle myself anything related to certificates (including the list of ciphers, the generation of new certificates, the compromised CAs ...), the current certificate system feels like the equivalent of installing updates with .tar.gz archives.