If nixos is doing that they're not alone. Fedora is in essentially the same camp unless it changed in the latest release: It's pgp signed but with a totally n

If nixos is doing that they're not alone. Fedora is in essentially the same camp unless it changed in the latest release: It's pgp signed but with a totally new key with every release and that pgp key isn't signed by anything else, and the only way to verify it is ... to download it from the same place you got your iso from. A number of years back openssl changed their pgp key and for a month didn't publish it anywhere. AFAICT I was the first person to complain about it-- which also suggests that all the distros that had already shipped the update hadn't checked it.