Sylva describes adopting Sigstore signing, SLSA, OpenSSF Scorecard and the Best Practices Badge for software supply-chain security, while noting gaps in nested artifacts and GitLab support. It frames CRA readiness as voluntary transparency work, not certification, aimed at helping downstream integrators.