I'm adding ucert and luci as default packages, which are normally not included (in snapshot builds). I'm using the server for my own devices as well and they all trust the ASU build key. This is a security improvement from my point of view but since people may don't want this I'm already thinking on how to make it optional.
- does this pose interoperability issues with official or personal builds?
No, ucert is only activate if you actively require key checking via an extra env variable.
- is there an ethical obligation to disclose custom modifications that deviate from official releases?
It shows you the list of installed packages which I'd consider as "disclosure".
Overall, please use the other thread for such questions, this thread is meant for the firmware wizard which only allows to download stock images.
Update: I modified ASU to no longer add the public CA key and also removed ucert from the default package selection. This weakens the upgrade security but removes any "hidden" modifications.
Whoever want's security on the upgrade server should install the two packages auc and ucert, the former allows custom image requests from a running device and the latter verifies them.