I worked on a code signing library years ago that fed data to safety critical systems. Other than the one coworker who suggested we add a sign-off step where we manually verified the SHA-1 hashes (which caught that we had recompiled one of the libraries ourselves, oops!) I had to defend my decision to check all of the dependencies into version control and manually update them.

This class of problems has been around for ages, the noise is just getting louder every day.