AFAIK several language package managers have looked at implementing TUF for their repositories, but the only live implementation that I know of is Docker Conten

AFAIK several language package managers have looked at implementing TUF for their repositories, but the only live implementation that I know of is Docker Content Trust. I kind of think it's an important part of secure management of libraries. As the Fosshub breach last week showed, software repo's are tempting targets for attackers...