> When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? Derivations can be signed already, and are signe

> When that work is done, will it be a strong enough guarantee to use instead of just gpg-signing derivations? Derivations can be signed already, and are signed in the official cache I believe. You can configure which keys to trust. In that sense, it think it is possible to mirror the official cache.