It's one tool of many that can be used to prevent malicious software from sneaking in to the supply chain.