I don't understand this reaction to TUF, at all. The post you link to explains that "APT addresses all attacks TUF addresses", which implicitly recognizes the v

I don't understand this reaction to TUF, at all. The post you link to explains that "APT addresses all attacks TUF addresses", which implicitly recognizes the value in TUF's design. If you're going to rebuild the entire trust and signature system of APT, why roll your own crypto instead of adopting the model designed by an academic that has been proven useful in other situations (e.g. Docker and Notary)?