keep an origin branch with the files debian ships
  
Not sure quite how to do this yet, it seems it would need to clone
the repo, switch to origin, and commit, then push back to /etc,
and either merge origin or commit a second time.
And do this after apt runs only, of course.

Alternatively, commit in /etc, then clone the repo, switch to origin, and
cherry pick the commit into origin?

Of coure, unless etckeeper is installed by debootstrap or thereabouts,
you won't have a true pristine origin branch.

etcgit manages this, maybe steal its method?
git://git.debian.org/git/users/jo-guest/etcgit.git