{pkgs ? (builtins.getFlake "nixpkgs").legacyPackages."x86_64-linux"}:
pkgs.stdenv.mkDerivation {
  name = "archlinux_signing_keys";

  outputHash = "sha256-evGWzkxMaZw3rlixKsyWCS/ZvNuZ+OfXQb6sgiHz9XY=";
  outputHashAlgo = "sha256";
  NIX_SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";

  nativeBuildInputs = with pkgs; [
    sequoia-sq
  ];

  dontUnpack = true;

  buildPhase = ''
    sq --verbose --no-cert-store --no-key-store network wkd fetch pierre@archlinux.org --output "$out"
  '';
}