Trust our substitutors in CI
A couple of CI jobs log this (or similar):
$ nix develop -Lv --fallback $CI_PROJECT_DIR# -c bash -c " ./boot && configure_ghc; pushd hadrian; cabal new-update; cabal new-build -j all; popd; echo :q | hadrian/ghci | tail -n2 | grep 'Ok,'; hadrian/build -j --flavour=quickest; hadrian/build -j --flavour=quickest test --test-root-dirs=testsuite/tests/programs;"
evaluating file '<nix/derivation-internal.nix>'
evaluating derivation 'git+file:///builds/ghc/ghc.nix?shallow=1#devShells.x86_64-linux.default'...
evaluating file '/nix/store/kn3inh4vxsbp16qx0yr6yfxg19kni5fs-source/flake.nix'
warning: ignoring untrusted flake configuration setting 'extra-substituters'.
Pass '--accept-flake-config' to trust it
warning: ignoring untrusted flake configuration setting 'extra-trusted-public-keys'.
Pass '--accept-flake-config' to trust it
(https://gitlab.haskell.org/ghc/ghc.nix/-/jobs/2054605/viewer#L238)
I think it should be fine to allow our substituter (see https://gitlab.haskell.org/ghc/ghc.nix/-/blob/583b3d370ee4adf63d335c783e4dac8281d32b1e/flake.nix#L5). Finally, this is only trusting ourselves.
This could cut some CI run time as we may fetch some cached artifacts (from our substituter.)