Anybody proposing an SBOM or a scorecard here is fundamentally unserious though please just ignore them