Within the cloud native and container space, there is work being done on how to implement this (SBoM, Signing etc). It will obviously be tricky to get right, bu

Within the cloud native and container space, there is work being done on how to implement this (SBoM, Signing etc). It will obviously be tricky to get right, but there are groups looking at it :) https://github.com/cncf/tag-security/ https://github.com/cncf/tag-security/ is a good place to go for more info.