It really limits the value of a stolen or leaked key. Similarly it limits the amount of trust you need in the key holder. If the NSA could steal a debian key (

It really limits the value of a stolen or leaked key. Similarly it limits the amount of trust you need in the key holder. If the NSA could steal a debian key (or coerce a packager), without deterministic builds, they could put a backdoor in a popular Debian package with barely any chance of getting caught. Deterministic builds make it much easier to detect this. That makes the value of such a stolen/coerced key much lower. Making it much less likely this gets attempted, and likely stopping anyone who used to try this attack.