I don’t quite understand how your desired solution for software supply chains actually achieves much. Content addressability doesn’t seem different from checks

I don’t quite understand how your desired solution for software supply chains actually achieves much. Content addressability doesn’t seem different from checksums or subresource integrity. IPFS requires file pinning, so who is owning that and how is it different from a current state package distributer? Further, someone/a build-machine still has to upload to the storage network… so Now we need smart contract to build (plus a coin)? … then we’ll need a coin for the compute providers? And even if we have all of that, Charlie still employs his advanced supply chain attack upstream like he normally does… and we’re still left with malware plus a bubble of infra that didn’t quite solve much it was funded millions to solve.