WoT verify pinned nixpkgs

[nixbitcoin]

Time Horizon: Short term

Description: Update both nixpkgs and nixpkgs-unstable only to signed commits by trusted maintainers whose keys have been verified through the WoT or in person.

Motivation: Continuation of nix-bitcoin hardening efforts.

Implementation: Find trustworthy maintainers who regularly commit signed commits to either nixpkgs or nixpkgs-unstable, verify their PGP keys through WoT or in person, write standard to only pin those commits, follow the standard.

[nixbitcoin]

This has turned out to be security theater. Maybe there will be an actual solution someday like flake authentication