Vbox-sync is a tool to distribute VirtualBox images via apt-get that Phil Kern and I wrote as part of our work for itomig.de, a German Free Software consulting company, and the LiMux project. I also held a talk about it at the Debian Conference in Extremadura, Spain, in 2009.
This solves a problem for me, I'll try it out next time I'm working there.
One thing I've always been skeptical about is deb packages that downloaded itself after being installed. Think Java and others that needed click through license, my main problem was that it's not clear how to make a mirror for the packages that need these kinds of download. Hiding Java or box image in a deb package feels like a fancy way to store a URL..
But as I said it solves a problem and it's the "only" way to do it. At least without changing how .deb works, and all the tools that do the mirroring.. :-)