Thanks, quite an achievement they got people to agree on the interface. However, for supply chain attacks the danger lurks in the implementation, not in the interface. You could argue that this approach comes with the benefit that one could switch implementation when one library goes rogue, but that is imho too little and too late.