I will +1 this. I generally end up copying a bunch of the required control files from another project and using a higher level script which creates the deb for me via black magic. I would love to understand the process more, but the depth of knowledge required to grok the process from end-to-end is well beyond the time I can commit to it.

On a related note, the way that repos can only be secured as a whole (and require each package to effectively be present when creating the signature) makes adding a single authenticated package to an existing repo much harder than it needs to be.