browser running in RAM

What does this mean?

The security theater is strong in this one.

"Nothing on this page asks for your faith.", immediently followed by a whole list of "trust me" (to manage the keys correctly, that the person notices the keys getting stolen, that she manage the entire signing process correctly, ...). No HW is used that could make it harder to steal keys, just some offline USB storage and a password manager. Every mainstream distro does way better than this, incl. Void linux this is based on.

No systemd with all the security improvements that brings either, but I guess that will bring in a small fan base:-)

I'm getting AI slop and security theatre vibes. The cross-signed keys is especially pointless when both are owned by the same person physically. No one will steal just one, they'll steal both.

And its impossible for an end user to verify that the packages are actually clean, there is way too much surface area for a compromised package to be slipped in.

I am interested. May check it out.