Torrouter Update Mechanism

How do you suppose Torrouter gets updated? Do you intent to use the Debian repositories?

Debian packages will require updating. At some point even a distro upgrade will be required. Also Tor has to be updated.

Torrouter is supposed to be run by normal people who don't like or can't administrate the box.

One buggy update in Debian may result in a lot boxes no longer booting, no longer connecting or no longer being accessible over the web interface.

Perhaps it would be best if tpo would handle all updates? You could have a stable distribution and a testing distribution with the goal that never too many boxes break at once and that they never need manual administration.