You own your dependencies. An end user shouldn't be expected to investigate and trust your entire supply chain, they expect you to do that. Imagine if a food c

You own your dependencies. An end user shouldn't be expected to investigate and trust your entire supply chain, they expect you to do that. Imagine if a food company was like, "Oh, well, the marble dust sold to us as flour was from a supplier so we're not really responsible."