Thanks for the pointer! How slick would it be if someone extended this project to distribute verifiable binaries which then underwent a final, local keysigning step.