This reads a bit like saying "it's strange that this academic paper doesn't advertise our private company." Especially since TUF and in-toto don't seem to handl

This reads a bit like saying "it's strange that this academic paper doesn't advertise our private company." Especially since TUF and in-toto don't seem to handle the core issue of having to use open-source libraries written by untrusted developers.