These are great steps, but the one publishing option I didn't see listed is to only allow trusted publishing (no token-based publishing, no local 2FA publishing). Is that being considered as well?