> The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters.

There's a really fascinating project by the authors of TUF called in-toto[1] that addresses exactly this problem.

[1] https://in-toto.github.io/