Nix is absolutely not just for CI, the idea is to use it locally as well, so the CI runs in the same environment.

Note that any user listed in nix.settings.trusted-users can place arbitrary directories into the Nix store, and can choose the store key.

It stores one of the keys to my LUKS volume.

I do actually use the TPM for disk encryption and Measured Boot, and can’t simply disable it.