Use signed builds on substituter

substituterbuild.sh

@@ -2,9 +2,9 @@
 set -euo pipefail
 set -x
 
-export NO_REMOTE=true
+BUILD_ARGS=("--secret-key-files" "/etc/nix/key.private")
 for machine in machines/*
 do
-    output=$(./build.sh $machine)
+    output=$(./build.sh "${BUILD_ARGS[@]}" "$machine")
     nix-env --set -p /nix/var/nix/profiles/per-user/charlotte/${machine#machines/} $output
 done