Well, that's a good thing if they are open to creating a community, which is what they're looking for on first inspection. The idea of using a directed acyclic

Well, that's a good thing if they are open to creating a community, which is what they're looking for on first inspection. The idea of using a directed acyclic graph, along with content addressable artifacts (or representation of external artifacts) could potentially work well alongside spdx and other standards for identifying packages and dependencies at a higher level of abstraction. Delivering a git repo as your SBOM has distinct advantages in terms of tooling and reproducability, and general "gitops"/git flow processes accomodate multiple releases and signed tags to provide roots of trust for SBOMs.