Hi network operators, As RPKI validation continues to become increasingly broadly deployed (yay!), I wanted to highlight and ask what deployment policies are towards dependency validation and pinning of RPKI validation software. For example, routinator's dependency graph is somewhat large, and includes at least one or two single-maintainer projects[1] which could inject arbitrary results into the RPKI-based filters. Certainly routinator is not the only project to fall prey to modern development practices which tend to have an exponentially expanding TCB, which makes it a concern that has landed in the laps of sysadmins instead of developers. I assume the large players are considering these issues and taking them into account when deploying, eg by writing tools to compare the feeds of multiple RPKI validators and rejecting any differences, am I correct in that assumption, and are there any open source projects to do so that smaller operators should be looking at using as well? Matt [1] eg https://github.com/vorner/log-reroute could edit your RPKI feed if, vorner wanted to.