I do know some of the arch maintainers (e.g. dvzrv IIRC) are working on build infrastructure that would completely automate the build process and HSM signing to

I do know some of the arch maintainers (e.g. dvzrv IIRC) are working on build infrastructure that would completely automate the build process and HSM signing to separate read-only images on build servers[0, 1, 2]. I haven't heard about updates to buildbtw in a while, but development seems still somewhat active and signstar is mentioned now and then at some conferences. It feels like it is not making any progress, but I don't pay any attention to the development, so it is likely just my perception of it just having been waiting on visible process to it and not seeing it. [0]: https://gitlab.archlinux.org/archlinux/signstar https://gitlab.archlinux.org/archlinux/signstar [1]: https://gitlab.archlinux.org/archlinux/signstar-os https://gitlab.archlinux.org/archlinux/signstar-os [2]: https://gitlab.archlinux.org/archlinux/buildbtw https://gitlab.archlinux.org/archlinux/buildbtw