I trust Arch far more than other distros, but I can't really use it in a production environment. Unless you take the care to automate the upgrades every 1-3 months, your machine will quickly require a handful of hacks to fix. As a gentoo lover, this isn't very difficult, but when you have, say, a customized digital audio workstation for a client, that needs to "just work" during upgrades (which, debian/KXStudio handles admirably), yaourt -Syu is like rolling the dice whether or not things will continue to build.
AUR aside (even though, as an expert, it's a fantastic resource), the repositories need keys trusted before they can be used, but nowhere in the documentation is this mentioned. When browsing the forums, you are often encouraged to not use keys, and just do everything unsecured.
I no longer trust Debian or Canonical, so I'm trying to migrate to a distribution not registered in (or under the control of) a Nation State involved in Five Eyes agreements, which is pretty much limiting me to Manjaro, Arch and Gentoo.