Those criticisms seem reasonable. Regarding package signing, are you referring to github.com/NixOS/nix/issues/613#issuecomment-1343…? Additionally, that default for pip seems veritably insane. I understand using system packages, but modifying packages outside the virtual environment is definitely weird.