It was never the solution to begin with, IMHO. It's lacking a permissions or let's say authz framework. It's only half the solution. And it's too complicated and there's no real standard, as in real world standard. Everyone has their own little soup cooking, because the manifest is incomplete and always evolving.