Reproducible builds of Pico FIDO2 firmware for the RP2350

I wanted a hardware security key and after some searching decided to build one myself, based on an open source project and a €10 Waveshare RP2350-One. The build worked on the first try, but it reached out to the network while building, and I realized I didn’t much like not knowing exactly what I was flashing onto my device every time. So I thought maybe Nix could help. The flake linked above pins every upstream requirement in flake.lock. Nothing is vendored, and the upstream tree isn’t patche...