A neat concept, however this doesn't give me a ton of confidence to use it.

An example is this bit: https://github.com/ublue-os/bluefin/blob/main/usr/bin/ublue-...

That runs as root not one but three bits of mutable shell scripts from the internet.

I love me some nix, but the most reproducible package manager should not be install via a hodpodge of directly running scripts from the Internet. Really nothing from my distribution should be doing that.

At the very least they should be vendored as part of the project so you can see when these scripts change.