Sorry for noise, I found the likely reason: https://sources.debian.org/src/geoipupdate/7.1.0-1/debian/control#L8
That is, you are using 'Build-Depends-Arch' instead of 'Build-Depends' to pull in 'golang-github-cenkalti-backoff-dev'. None of my methods to find reverse build dependencies seem to deal with this. I'm reading https://www.debian.org/doc/debian-policy/ch-relationships.html about the header, but it doesn't manage to enlighten me. I don't recall using this header myself, so I don't know its exact semantics. Is 'geoipupdate' right to use Build-Depends-Arch here? Why doesn't 'dak rm' complain about removing a package? Why doesn't ratt/dose identify this package? /Simon
signature.asc
Description: PGP signature
