Question: is tea only targeted at the subset of open-source projects that are available through package managers? (I.e., libraries mostly.) Like npm packages, Rust crates, Debian packages, etc.?
We intend to aggressively expand this (I have soft spot for Swift) but also have plans for eventually decentralizing this properly relying only on release tarballs that can be signed proving attachment to the wallets registered with the tea protocol.
I'm fully aware just how much amazing open source is outside package managers but we really believe in doing this problem well and that also meant limiting ourselves at the outset to established and reputable third party data.