Breakdown of python-certbot changes; this is a NEW package going into trusty backported from bionic following the letsencrypt->certbot name change. A revised debdiff is attached to this bug.

diff -Nru python-certbot-0.23.0/debian/compat python-certbot-0.23.0/debian/compat
--- python-certbot-0.23.0/debian/compat	2018-03-23 23:00:13.000000000 +0000
+++ python-certbot-0.23.0/debian/compat	2018-11-25 16:20:44.000000000 +0000
@@ -1 +1 @@
-11
+9

Explanation: Debhelper compat change

diff -Nru python-certbot-0.23.0/debian/control python-certbot-0.23.0/debian/control
--- python-certbot-0.23.0/debian/control	2018-04-07 03:21:05.000000000 +0000
+++ python-certbot-0.23.0/debian/control	2018-11-25 16:20:44.000000000 +0000
@@ -1,47 +1,41 @@
 Source: python-certbot
 Section: python
 Priority: optional
-Maintainer: Debian Let's Encrypt <email address hidden>
+Maintainer: Ubuntu Developers <email address hidden>
+XSBC-Original-Maintainer: Debian Let's Encrypt <email address hidden>
 Uploaders: Harlan Lieberman-Berg <email address hidden>,
            Francois Marier <email address hidden>
-Build-Depends: debhelper (>= 11~),
+Build-Depends: debhelper (>= 9~),
                dh-python,
-               python3,
-               python3-acme (>= 0.22.0~),
-               python3-configargparse (>= 0.10.0),
-               python3-configobj,
-               python3-cryptography (>= 1.2),
-	       python3-distutils,
-	       python3-josepy,
-               python3-mock,
-               python3-parsedatetime (>= 1.3),
-               python3-repoze.sphinx.autointerface,
-               python3-requests (>= 2.4.3),
-               python3-rfc3339,
-               python3-setuptools (>= 1.0),
-               python3-sphinx,
-               python3-sphinx-rtd-theme,
-               python3-tz,
-               python3-zope.component,
-               python3-zope.interface
+               python,
+               python-acme (>= 0.22.0~),
+               python-configargparse (>= 0.10.0),
+               python-configobj,
+               python-cryptography (>= 1.2),
+	       python-josepy,
+               python-mock,
+               python-parsedatetime (>= 1.3),
+               python-requests (>= 2.4.3),
+               python-rfc3339,
+               python-setuptools (>= 1.0),
+               python-sphinx,
+               python-sphinx-rtd-theme,
+               python-tz,
+               python-zope.component,
+               python-zope.interface
 Standards-Version: 4.1.4
 Homepage: https://certbot.eff.org/
 Vcs-Git: https://salsa.debian.org/letsencrypt-team/certbot/certbot.git
 Vcs-Browser: https://salsa.debian.org/letsencrypt-team/certbot/certbot
 Testsuite: autopkgtest-pkg-python

Explanation:  Some of the dependencies for certbot do not have Python3 versions in Xenial; this was resolved by having certbot use Python2 and becoming a python2 package; it could also have been resolved by SRUing python-parsedtimedate as it supports Python 3 but doesn't have the necessary deb. An SRU for the bionic package may be needed to remove this with the Python 3 version.

-Package: python3-certbot
+Package: python-certbot
 Architecture: all
-Depends: python3-acme (>= 0.22.0~),
-         python3-requests (>= 2.4.3),
+Depends: python-acme (>= 0.22.0~),
+         python-requests (>= 2.4.3),
          ${misc:Depends},
-         ${python3:Depends}
-Recommends: certbot
+         ${python:Depends}
 Suggests: python-certbot-doc
-Breaks: python-certbot-nginx (<< 0.20.0),
-        python-certbot-apache (<< 0.20.0),
-        python-letsencrypt (<= 0.6.0)
-Replaces: python-letsencrypt
 Description: main library for certbot
  The objective of Certbot, Let's Encrypt, and the ACME (Automated
  Certificate Management Environment) protocol is to make it possible

Explanation: 3->2 changes. python-letsencrypt in xenial will be a shim that provide import letsencrypt and should not be removed when this package is installed to provide ABI compat within a release

@@ -62,14 +56,14 @@
 Package: certbot
 Section: web
 Architecture: all
-Depends: python3-certbot (= ${source:Version}),
+Depends: python-certbot (= ${source:Version}),
          ${misc:Depends},
-         ${python3:Depends}
+         ${python:Depends}
 Breaks: letsencrypt (<= 0.6.0)
 Replaces: letsencrypt
 Provides: letsencrypt
-Suggests: python3-certbot-apache,
-	  python3-certbot-nginx,
+Suggests: python-certbot-apache,
+	  python-certbot-nginx,
           python-certbot-doc
 Description: automatically configure HTTPS using Let's Encrypt
  The objective of Certbot, Let's Encrypt, and the ACME (Automated

Explanation: Python 3->2 changes for the extension modules. We may backport nginx support at a later date so it was left in as a suggests even though it's dangling at the moment.

@@ -110,12 +104,3 @@
    - Help you revoke the certificate if that ever becomes necessary.
  .
  This package contains the documentation.
-
-Package: letsencrypt
-Section: oldlibs
-Architecture: all
-Depends: certbot,
-         ${misc:Depends}
-Description: transitional dummy package
- This is a transitional dummy package for the rename of letsencrypt to certbot.
- It can safely be removed.

Explanation: Transitional package removed due
diff -Nru python-certbot-0.23.0/debian/letsencrypt.postrm python-certbot-0.23.0/debian/letsencrypt.postrm
--- python-certbot-0.23.0/debian/letsencrypt.postrm	2018-03-22 01:12:02.000000000 +0000
+++ python-certbot-0.23.0/debian/letsencrypt.postrm	1970-01-01 00:00:00.000000000 +0000
@@ -1,41 +0,0 @@
-#!/bin/sh
-# postrm script for letsencrypt
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# summary of how this script can be called:
-#        * <postrm> `remove'
-#        * <postrm> `purge'
-#        * <old-postrm> `upgrade' <new-version>
-#        * <new-postrm> `failed-upgrade' <old-version>
-#        * <new-postrm> `abort-install'
-#        * <new-postrm> `abort-install' <old-version>
-#        * <new-postrm> `abort-upgrade' <old-version>
-#        * <disappearer's-postrm> `disappear' <overwriter>
-#          <overwriter-version>
-# for details, see https://www.debian.org/doc/debian-policy/ or
-# the debian-policy package
-
-
-case "$1" in
-    purge)
-        rm -rf /var/log/letsencrypt
-    ;;
-
-    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
-    ;;
-
-    *)
-        echo "postrm called with unknown argument \`$1'" >&2
-        exit 1
-    ;;
-esac
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-exit 0

Explaination: python-letsencrypt/letsencrypt is sticking around as a package so the postrm script was removed.

diff -Nru python-certbot-0.23.0/debian/patches/disable-autointerface-docs python-certbot-0.23.0/debian/patches/disable-autointerface-docs
--- python-certbot-0.23.0/debian/patches/disable-autointerface-docs	1970-01-01 00:00:00.000000000 +0000
+++ python-certbot-0.23.0/debian/patches/disable-autointerface-docs	2018-11-25 16:20:44.000000000 +0000
@@ -0,0 +1,43 @@
+Description: Disables the autointerface for docs
+ The Skyphinx version in Xenial doesn't have the necessary support
+ to build all the API docs so disable it
+ .
+ python-letsencrypt (0.23.0-1ubuntu0.16.04.1~ppa1) xenial; urgency=medium
+ .
+   * Backport to Xenial (LP: #1640978)
+Author: Michael Casadevall <email address hidden>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1640978
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: https://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: 2018-11-25
+
+--- python-letsencrypt-0.23.0.orig/docs/conf.py
++++ python-letsencrypt-0.23.0/docs/conf.py
+@@ -44,7 +44,6 @@ extensions = [
+     'sphinx.ext.todo',
+     'sphinx.ext.coverage',
+     'sphinx.ext.viewcode',
+-    'repoze.sphinx.autointerface',
+ ]
+ 
+ autodoc_member_order = 'bysource'
+--- python-letsencrypt-0.23.0.orig/setup.py
++++ python-letsencrypt-0.23.0/setup.py
+@@ -68,7 +68,6 @@ dev_extras = [
+ ]
+ 
+ docs_extras = [
+-    'repoze.sphinx.autointerface',
+     # autodoc_member_order = 'bysource', autodoc_default_flags, and #4686
+     'Sphinx >=1.0,<=1.5.6',
+     'sphinx_rtd_theme',

Explanation for patch: repoze.sphinx.autointerface is unavailable on Xenial; it's used to create some of the API documentation and is not mandatory so I dropped it from the sphinx config. THe resulting docs might be a little weird but are present.

diff -Nru python-certbot-0.23.0/debian/patches/series python-certbot-0.23.0/debian/patches/series
--- python-certbot-0.23.0/debian/patches/series	2018-03-22 01:12:02.000000000 +0000
+++ python-certbot-0.23.0/debian/patches/series	2018-11-25 16:20:44.000000000 +0000
@@ -1 +1,2 @@
 0001-remove-external-images.patch
+disable-autointerface-docs

Explanation: Adding the above patch.

diff -Nru python-certbot-0.23.0/debian/rules python-certbot-0.23.0/debian/rules
--- python-certbot-0.23.0/debian/rules	2018-04-07 03:22:04.000000000 +0000
+++ python-certbot-0.23.0/debian/rules	2018-11-25 16:20:44.000000000 +0000
@@ -2,19 +2,23 @@
 
 export PYBUILD_NAME = certbot
 
+include /usr/share/dpkg/pkg-info.mk
+
 %:
-	dh $@ --with python3,sphinxdoc --buildsystem=pybuild
+	dh $@ --with python2,sphinxdoc --buildsystem=pybuild
+
+clean: debian/control
+	dh_clean
 
 override_dh_install:
-	mkdir -p debian/certbot/usr/bin debian/certbot/etc/letsencrypt
-	mv debian/python3-certbot/usr/bin/* debian/certbot/usr/bin
-	rm -rf debian/python3-certbot/usr/bin
-	mv debian/cli.ini debian/certbot/etc/letsencrypt/cli.ini
-	http_proxy='127.0.0.1:9' \
-		https_proxy='127.0.0.1:9' \
+	mkdir -p debian/certbot/usr/bin
+	mv debian/python-certbot/usr/bin/* debian/certbot/usr/bin
+	rm -rf debian/python-certbot/usr/bin
+	PYTHONPATH=. PATH=../debian/certbot/usr/bin:${PATH} \
+		http_proxy='127.0.0.1:9' \
 		sphinx-build -N -bhtml docs/ build/html
-	http_proxy='127.0.0.1:9' \
-		https_proxy='127.0.0.1:8' \
+	PYTHONPATH=. PATH=../debian/certbot/usr/bin:${PATH} \
+		http_proxy='127.0.0.1:9' \
 		sphinx-build -N -bman docs/ build/man
 
 override_dh_installsystemd:
@@ -23,9 +27,3 @@
 
 override_dh_installinit:
 
-override_dh_installdocs:
-	dh_installdocs --doc-main-package=python3-certbot -p python-certbot-doc
-	dh_installdocs -p certbot -p python3-certbot -p letsencrypt
-
-override_dh_installexamples:
-	dh_installexamples --doc-main-package=python3-certbot -p python-certbot-doc

Explaination: Change build to use python2, drop docs/examples not to symlink with the main package as that was not supported with debhelper 9. Docs/examples end in the correct package (tested maually)