If you're more concerned about trademark issues, you could probably just use CC-BY and then mention somewhere that rhe logo is trademarked (as long as you don't use the (R) symbol implying registration of those trademarks).
Alternatively, if you want to use CC-BY-ND, your icon would not be distributed with Debian, but would be available through non free repositories. You could, as others have mentioned, have a generic "free" icon to use as a fallback, and then, if users choose go download the nonfree icon, they want to. This is all very mildly annoying, but it solves the problem we've been talking about for 20+ emails.