TUF defines a series of threat models which are uniquely and clearly enumerated. It then provides a series of protocols for reasonable key rotation systems tha

TUF defines a series of threat models which are uniquely and clearly enumerated. It then provides a series of protocols for reasonable key rotation systems that address those threats. "Those threats" in this case are things which major package managers you rely on currently get dangerously wrong. (I'd rather leave this sans naming of names and as a "think critically" thing, but seriously: for one example, look at apt and how it handles rollback prevention.) TUF is not a pointless competing new standard. It contains useful information and constructive thoughts. If you think the 15-standards XKCD is a relevant dismissal... try giving it another read in the morning. (I'm sorry, but this XKCD really raises my hackles when used wantonly. I've never seen such a good description of threats to update systems as the TUF spec. I link to it constantly as an educational material. It's really not constructive to dismiss it with a webcomic link.)