NixOS and reproducible builds could have detected the xz backdoor