If TUF has a bug or is broken then the software updater will break.

[monzum]

If we are using the interposition method to implement TUF into our sofware updater, and TUF has a bug that prevents it from pulling updates, then the software updater breaks completely. That is we will not be able to push any new updates including updating the software updater (depending on the severity of the bug).

The application developer may write defensive code to handle this case. For example the application developer may surround the urlretrieve call with a try/except block and default to the original urllib in case of an unexpected exception. However this will defeat the purpose of TUF interposition and will no longer make TUF transparent to the application.

[JustinCappos]

This is okay. I think the paranoid will want to be careful with TUF as they first add it. However, this should not be a major concern once it is very stable and the use of multiple keys / roles is well understood.