> just have two (or more) identical servers in separate locations under different people's control "just"... The whole point of reproducible builds is for many

> just have two (or more) identical servers in separate locations under different people's control "just"... The whole point of reproducible builds is for many 3rd parties to be able to rebuild packages easily and get consistent outputs without having to spend months to set up a perfectly "standard" buildbot. Many large orgs are already rebuilding stuff anyways - adding security checks is going to be easy. > No need to fuzz the dates No, you still need to handle that. > a bribed/black-mailed Debian maintainer slips in a patch to some of the tens of thousands of packages they tweak No, other developers and 3rd parties will notice the patch being applied by the build tools.