Nice talk! Sounds like there's no silver bullet... I'm curious to hear your opinion about a combination of digital signing with e.g. keybase/blockchain + reput

Nice talk! Sounds like there's no silver bullet... I'm curious to hear your opinion about a combination of digital signing with e.g. keybase/blockchain + reputation system, a sandboxed development environment (mitigates the "short con" risk) and a sandboxed production environment, with the minimum set of permissions required to operate (as well as auditing of course). Call me pessimistic but I don't see developers taking on the extra friction given the status quo. Though a major data breach or two might change things, as I'm sure we'll find out sooner or later.