Managing the software supply chain: Trusted updates from dev to device