Handling Multi-Arch packages that must be installed for every enabled architecture?

[Josh Triplett <josh@joshtriplett.org>]

Some packages, if installed on any architecture, must be installed for
every enabled architecture.  Most notably, an NSS or PAM module package,
if enabled in /etc/nsswitch.conf or /etc/pam.d respectively, must exist
for every enabled architecture to avoid breaking programs for that
architecture.

As one possible solution for this problem (but not an ideal one, just a
thought experiment), dpkg could support a new value for "Multi-Arch",
"Multi-Arch: every".  This value would imply "Multi-Arch: same", but if
installed, would additionally cause dpkg to act the same way it does for
Essential packages: install the package when enabling the architecture.
(And when installing the package, dpkg would need to require installing
it for every supported architecture; dpkg could refuse to configure the
package if any enabled architecture doesn't have it unpacked.)

That would solve the problem for the couple of cases it has come up in,
but it seems far from ideal; I'd welcome an cleaner alternative
solution.  Notably, this doesn't work well for plugin packages for
libraries less critical than glibc; it's not even ideal for PAM, as not
every enabled architecture will have packages depending on libpam0g.
The real dependency is "if any package on the architecture depends on
package X, and package Y is installed, package Y:arch must be
installed", but that's excessively complicated.

Any ideas on how to solve this problem?

- Josh Triplett