“Packages should be reproducible” added to Debian Policy
>Any packages that absolutely cannot be built in a reproducible way[1] ... [1] Such as random noise added to kernel and firmware data structures during local builds, to be used as a last defense to avoid the herd using same keys effects, etc.Shouldn't this example of randomness still be pushed to the installation stage, instead of in the distribution. If Debian's binary package contains a "random" key, then we have a pretty large herd already using it.