I appreciate this.

I can’t help but feel that this comes a bit short. An attacker could be on the upstream side of a company as well. Not to mention they could be complicit in the attack.

Seedsigner would seem to fix some of these issues.