Email addresses wrt keys on PPA

The short answer is that it's simplest if all four match, but if they're all different then nothing very much goes wrong.

The address on your GPG key is mainly informational as far as Launchpad is concerned. It's used when people try to work out who a key belongs to, and if you expect to be able to exchange signed or encrypted email then it should match the email address you're using or people will probably get confused, but Launchpad doesn't require it to match an email address on your account.

When you sign a source package in preparation for upload, the debsign tool will look up a GPG key using the email address in debian/changelog, so it's easiest if that matches your key. However, it's also perfectly possible to override that by giving it the key ID (or, better, the full fingerprint) of a particular key instead, and many people do that to avoid problems if they have multiple unrevoked keys for whatever reason. See "man debsign" for details.

When you upload a source package, Launchpad checks what key signed it, looks for an account with that key attached to it, and treats the upload as coming from that user. The addresses in debian/changelog and debian/control don't have to match this, although they may be emailed about the upload if they're associated with a different Launchpad account. (For instance, this sometimes occurs in Ubuntu when a mentor reviews and signs somebody else's upload.)

The addresses in debian/changelog and debian/control will be rendered as links to the corresponding Launchpad accounts in Launchpad's web UI. If a corresponding account doesn't exist, then the upload processor will create a sort of placeholder account for them. You can claim that account and merge it into your own later, or you can just leave it alone.

In the case you describe, my recommendations would be:

 * List a project-specific email address in Maintainer, if you like. This can be a role address for people to email with questions about the project. It doesn't have to be associated with a Launchpad account, other than the autocreated one.
 * Normally, use your own address in debian/changelog. You, a real human, made the change.
 * It doesn't matter very much what address is on the GPG key, but the key itself needs to be attached to a Launchpad account that has the necessary upload permissions. If you're building significant automation of some kind then you might want to have a dedicated Launchpad account for this so that the automation doesn't have access to things it shouldn't, but in most cases it should probably just be attached to your normal personal account.