But Alpine does not even attempt reproducible builds, maintainer signing, etc. Running Alpine means anyone with access to the git repo or build server can push

But Alpine does not even attempt reproducible builds, maintainer signing, etc. Running Alpine means anyone with access to the git repo or build server can push any code they want to your system. Alpine is a musl research/hobby distro at best.