> Isn't this the exact opposite of what you want security wise?

Quite the opposite, I'd say? Everything needed is source controlled (and signed, if commits are signed).

Also, all the metadata can be queried by the ide (any ide) via an LSP. can you do that with the xml from maven/ant ?

I like this 1JPM so much I might adopt it for all my personal java projects.