We would be able to have a " Land" button in R4 Libre BusTO.
For security reasons this requires separated SSH credentials, so another Drydock Blueprint host, in order to separate the building stuff to the landing stuff.
Why? Because the building stuff should be considered very untrusted and dangerous and should never be able to interact with the landing stuff that should be kept without untristed contamination.
As already said this can be achieved with two SSH users on the same host because the default umask is good to avoid that one SSH user could be able to write from the other.