.changes (dot-changes) files are used in package uploads. They contain some information about the package extracted from the source package during the build (?version, maintainer), the changes in the current version pulled from the changelog, and the list of files in the upload.
A changes file is used in the ?upload of a package to the archive, and as such can be ?signed. As it contains the ?md5sums of the other files that will be uploaded then they cannot be changed without the signature failing to verfify.
The usual way to generate a changes file is by using dpkg-dev to build a package, though one could be created by hand, or another script.