What supply-chain risks exist when pulling models from Hugging Face or vendor APIs?

Risks

• Model poisoning: Malicious weights or fine-tunes — verify publisher, checksums, internal mirror.