The recent issue with NPM surfaced the following two major issues: - a package got unpublished - we demand an immutable package manager; - packages got hijack

The recent issue with NPM surfaced the following two major issues: - a package got unpublished - we demand an immutable package manager; - packages got hijacked - we need authenticity as basic as checksums or signatures. Anything that accomplishes the above in an uncomplicated manner will win my business. Any craptocurrency pitching will not.