They cover this - timestamps are embedded in the packages, and also signed. If they're too old it won't update and you'll know something is amiss.
Packages in debian and derivatives are not signed. Instead, the manifest that lists all the available packages and their checksums is signed. That's also where the expiration data is stored.