Secure Infrastructure [Crypto signed ISO images]

[grarpamp]

> What about the processor microcode, device(s) firmware, BIOS, extension
> ROM(s), ... , installed software [meaning upstream port source]... of the
> machines used to serve the repository and do the builds?

That is obviously outside the scope of the project to change/control.
Certainly you knew that when posting, and similarly why I didn't include it.

> boot managers, boot loaders, kernels, operating systems...

This is within said scope.