William Woodruff, better known online as "yossarian", has published
a blog post to make the case that users should not place their trust
in trusted
publishing:


Trusted Publishing is a mechanism for establishing trust between an
external machine identity (like a CI/CD workflow) and one or more
projects on a package index/registry. The "trust" in...