An append-only, signed ledger of vulnerability remediation