All NixOS machines now trust the Metacircular platform CA. This allows curl, browsers, and Go services to verify TLS certificates issued by Metacrypt without --insecure or custom CA flags. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>