There's a massive push right now from top down to have secure software supply chains. Google SBOM and SigStore. It's not an organic need but if you have government customers you don't have many options.

Ironically rewriting git history is a perfect opportunity for a supply chain attack.