As much as I like the -design- of Nix as a system overall, I would strongly discourage trusting it today for any production or security sensitive use case until

As much as I like the -design- of Nix as a system overall, I would strongly discourage trusting it today for any production or security sensitive use case until some concept of VCS signing, and review/release integrity is in place. See: https://github.com/NixOS/rfcs/blob/d178f63f9a588e463fdc075516fae4b48d9fd5f3/rfcs/0034-expression-integrity.md https://github.com/NixOS/rfcs/blob/d178f63f9a588e463fdc07551...