Thanks for replying. I'm certainly not meaning to imply that you are in on some conspiracy or anything - you were already in here clarifying things and setting

Thanks for replying. I'm certainly not meaning to imply that you are in on some conspiracy or anything - you were already in here clarifying things and setting the record straight in a helpful way. I think you are not representative of industry here (in a good way). Evangelists are certainly latching on to the ambiguity and using it as an opportunity. Try to pretend you are a caveman dev or pointy-hair and read the first screenful of this. What did you learn? https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/ https://github.blog/changelog/2025-07-31-npm-trusted-publish... https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-pu... https://www.techradar.com/pro/security/github-is-finally-tightening-up-security-around-npm-following-multiple-attacks https://www.techradar.com/pro/security/github-is-finally-tig... These were the top three results I got when I searched online for "github trusted publishing" (without quotes like a normal person would). Stepping back, could it be that some stakeholders have a different agenda than you do and are actually quite happy about confusion? I have sympathy for that naming things is hard. This is Trusted Computing in repeat but marketed to a generation of laymen that don't have that context. Also similar vibes to the centralization of OpenID/OAuth from last round. On that note, looking at past efforts, I think the only way this works out is if it's open for self-managed providers from the start, not by selective global allowlisting of blessed platform partners one by one on the platform side. Just like for email, it should be sufficient with a domain name and following the protocol.