A bug is the log checking code is no worse than a bug in your signature verification code. But obviously, denial-of-update attacks on the log infrastructure sho

A bug is the log checking code is no worse than a bug in your signature verification code. But obviously, denial-of-update attacks on the log infrastructure should be mitigated in some way before this is mandatory. An up-side to not having a fall-back mechanism is that you can't produce a secret update. No matter many 5$ a wrenches the NSA can afford (https://xkcd.com/538/ https://xkcd.com/538/).