Another possible way of writing this is:
<code>covered_sites = set(derived_global_permissions.values_list('sites', flat=True))</code>