[LanternLight83]

I was going to say, I've got my got server on my NAS, which is itself on a ZFS filesystem, through which snapshots provide immutable backups;

But considering the case of a malicious got contributer, access to any of my devices and ssh keys is already a wayyy bigger issue to begin with, and likely entails restoring the rest of the system to a known-secure state due the sheer number of files an intruder could have tampered with outside of version-controlled directories.