Honestly, best of luck, but it's mostly to do with PKI. The DoD PKI office won't issue code signing certificates for NPE users, so artifact provenance assurance

Honestly, best of luck, but it's mostly to do with PKI. The DoD PKI office won't issue code signing certificates for NPE users, so artifact provenance assurance either can't be automated, which means it can't be scaled, or we're forced to use self-signed certificates, which combined with having small teams where everyone is forced to have admin privileges because no one actually owns the infrastructure and provides timely support for change management requests, leaves way too many systems incredibly open to insider threat.