Make ca-derivations require a `ca-derivations` machine feature, and ca-aware builders expose it. That way, a network of builders can mix ca-aware and non-ca-aware machines, and the scheduler will send them in the right place.
nix run
.config
nix flake check