If you go the route of Secureblue, just be sure to install Core into a container via Distrobox, that way you can download binaries directly from bitcoincore.org and perform manual PGP verification using the builder-keys from guix.sigs.

OK - great advice. Thanks!