To make an obvious point, this isn't needed to run Debian as
sys-firewall. It's needed to run Debian as an update proxy for dom0.
It's perfectly possible to use Debian for all the system services,
including as updateVM for everything else.
If you're willing to manually transfer updates to dom0 and install by
hand, you could dispense with fedora templates altogether. (I don't, but
you could.)
unman