Yeah, CachyOS has been working just fine for me. And while both of those points raise an eyebrow for me, I have also heard things about the Cachy team that do the same. Perfect can't be the enemy of good enough. Though to that second point you raised, I just watched a [Veritasium?] video recently on how just such a system-level package was very nearly compromised by what has all the hallmarks of a malicious state actor precisely because it was so seemingly innocuous and open.

I appreciate the clear and concise explanation. Cheers, friend.