I've tried to do a reasonable job with the krb5-config package of updating a user-managed krb5.conf and keeping it in sync with debconf data. It's quite old and I doubt it's best practice any more but it is an example of how to approach a non-shell-script package. The debconf-managed comment is an inadequate solution. Better than just somping on things and if that's all you have time for, then go for it. However if you can do better please do!