Quoting Goswin von Brederlow <firstname.lastname@example.org>:
Why do you have a debian/backup/ directory? I'm assuming you aren't
You're right, it turned out it was that simple. I originally got that warning because there really was a vellemaninstrumentation-dkms.substvars in the debian directory, and instead of deleting it, I created a backup directory for it. I missed the fact that the warning now complains about the files in that directory, so I thought I had not gotten rid of it. Thanks for spotting it!
Description: S/MIME Cryptographic Signature