hindsight is always 20/20

i'm sure <insert your favourite open source project here> would appreciate patches for reproducible, cryptographically signed releases