Less is safer: How Obsidian reduces the risk of supply chain attacks