i keep waiting for the part where a ledger helps endpoint telemetry more than a plain signed append-only log. compared with osquery + fleet, blockchain only really wins if you need multiple orgs to co-own the audit trail without trusting one operator, and even then the consensus path turns every event into a latency and availability problem. for actual detection and response, the hard bit is still the endpoint agent and the trust in what it reports, not who replicas the record later. if the paper has a clean answer to key rotation, agent compromise, and who is allowed to write on-chain, that would matter a lot more than the chain itself

Glad someone mapped the mess out, saving this for later.