It's a little unclear what you really want to know, since you seem to have found good resources, but I'll try to give a short (and not accurate in every detail) description of the process and hope I get the right parts included (I haven't worked with this in Debian's own repositories, but in different iterations of a setup at work, that grew ever bigger and more automated getting more and more like - how I understand - Debian's system). Every (maintained) package in Debian has a developer (or a team of developers), who locally (i.e. on his own machine(s) takes the upstream source code and makes some files that details how a Debian package should be made. He then collects that into a source package, which he signs with GPG and uploads to one of Debian's systems. If that system can verify the the source package came from a developer (by virtue of having a valid signature), it then sends the source package to a build host for each relevant architecture. Those packages, along with any binary packages uploaded directly by the developer, are then uploaded to the relevant repositories, and distributed to mirrors, from where you download and install them. The build host also signs the build packages (with some common key, it obviously can not sign stuff with developers's private keys), and the repository verifies those signatures.