I think this type of attestation gets us part of the way there, however, the solution needs to be a bit more generalized to cover all the threats. At TestifySe

I think this type of attestation gets us part of the way there, however, the solution needs to be a bit more generalized to cover all the threats. At TestifySec we are working on a open source pluggable attestation framework with a rego policy engine for verification. A review attestation (as proposed in this article) is pretty interesting and is an attestor I will probably add to our project. I wrote some high level thoughts on attestation here: https://www.testifysec.com/blog/what-is-a-supply-chain-attestation/ https://www.testifysec.com/blog/what-is-a-supply-chain-attes...