The other favourite besides Arch is NixOS. How does it compare when it comes to supply chain security?