I'm also using etcupdate. It's also the default for beinstall(8), a very nice tool to install updates into a separate boot environment.