i'm sure <insert your favourite open source project here> would appreciate patches for reproducible, cryptographically signed releases