This could help mitigate supply chain attacks, though it may not do much for projects without immutable releases.