Now that community PR#39 has merged and https://github.com/kata-containers/community/blob/master/VMT/VMT.md officially exists, it would be good to have the Kata Containers Architecture Committee properly delegate the functions described there to an initial small team of trusted volunteers from the Kata Containers community. This delegation should then be followed by some durable reference publication (perhaps within the above document) of a list of their names, contact addresses and OpenPGP public key fingerprints both to act as a fallback reporting channel in cases where Launchpad bug filing is undesired by the reporter and also to make it possible for the public at large to verify signed notices originating from these individuals. A corresponding item has been added to the 2018-11-05 AC call agenda.
The reason I'm raising this is, in part, because the embargo-notice ML Anne set up (which is intended for advance distribution of vulnerability fixes to downstream stakeholders of Kata software) is still only moderated by OSF staff at the moment. Ideally, the task of moderating this list would be handed off to the Kata Containers Vulnerability Management Team so that it serves as a final cross-check of each others' embargoed pre-KCSA notices to downstream stakeholders. If the AC wishes I'm willing to also participate as a list admin/moderator of last resort, in case there are emergency technical issues with management of the ML itself (as a longstanding member of the OpenStack project VMT I help run the corresponding mailing list it uses, so am well-versed in these matters).
It would also be good to ensure that the LP project https://launchpad.net/katacontainers.io (used both for private reporting of suspected security vulnerabilities and also formal requests to become subscribers of the embargo-notice ML) is shared with the Kata Containers VMT so that they can perform the functions outlined in their published process. I'm happy to assist the AC with making those configuration changes if desired.