I don't think this does enough to address to supply-chain security concerns. Before I use a crate, I want some assurance that the transitive deps have had a proper security audit, and that I'm not a single "cargo update" away from getting malware installed in my machine.