Nix does blind automated signing of binaries which only helps prevent the cache from being mutated between builds. It does not ensure the code that went into th

Nix does blind automated signing of binaries which only helps prevent the cache from being mutated between builds. It does not ensure the code that went into those builds was accurate. See rejected RFC for more details: https://github.com/NixOS/rfcs/pull/34 https://github.com/NixOS/rfcs/pull/34