Why do I feel like this set of posts by Russ about supply chain security will end up with a proposal/concrete first implementation of a supply-chain-verified-build process that starts at chip making - simple enough to analyze and rebuild independently- to bootstrap a go runtime that provides an environment to do secure builds.

Reflections on Trusting Trust becomes even more interesting if you consider photolithography machines being backdoored.