An SBOM Tells You What You Shipped; It Does Not Prove You Shipped the Right Thing
An SBOM inventories components. Supply-chain trust also needs provenance, build identity, signatures, policy, artifact verification, and release evidence that connects source to the bytes actually deployed.