After sending this bug I realized that it might not be possible to restrict dpkg-deb to only the users and groups defined by base-passwd since there might be derivatives (or organizations) with additional reserved users and groups.
Thus I'm closing this again. Sorry for the noise.
