> Yet no concrete suggestions. There are a bunch of concrete suggestions in the article: "By introducing universal signatures for packages of executable code,

> Yet no concrete suggestions. There are a bunch of concrete suggestions in the article: "By introducing universal signatures for packages of executable code, smaller channels and webs of trust, reproducible builds, and the many other straightforward, obvious techniques used by responsible package managers." I'm as pessimistic as the author, though, about how those suggestions will be received.