Pierre Neidhardt <mail@ambrevar.xyz> writes:

> The other way around would work (with root access): build everything on
> balaitou, guix publish there, then run "guix challenge" on Aneto.

Actually I don't think this works either: if the balaitou remote is
compromised, it may very lie about the challenge.

I don't know how `guix challenge' works so I may be wrong here.

-- 
Pierre Neidhardt
https://ambrevar.xyz/