[mahemm]

While this article does do a good job of illuminating the potential challenges, it's a bit frustrating that there's such scant discussion of solutions.

IMO, this problem has been solved pretty comprehensively by the TUF framework[1], which has a number of solid implementations[2][3]. Many of these implementations even have reliable third-party reviews, so should be pretty trustworthy.

[1]: https://theupdateframework.github.io/ [2]: https://github.com/flynn/go-tuf [3]: https://github.com/theupdateframework/notary

[_caw]

For a solution geared more towards the automotive use-case involving multiple vendors, see Uptane[1], a customization of TUF. The IETF is also working towards a standard for IoT updates[2] which I've found helpful.

[1]: https://uptane.github.io [2]: https://datatracker.ietf.org/wg/suit/documents/

[nrclark]

The solution that the article authors want is for you to buy their service.