What stops a large vendor from copying CueCrux?

Copying the feature list is easy; copying the properties is not, because the properties come from foundations most incumbents cannot adopt without rebuilding.

• Evidence must be the substrate. Signed, hash-chained receipts for every state mutation only mean something if there is no unsigned write path. Adding a "receipts feature" to an existing mutable store produces logs with extra ceremony, and auditors can tell the difference.
• Verification must not require the vendor. Offline verification is a deliberate transfer of power to the customer. Platform vendors whose value depends on being the trusted intermediary have an incentive problem with that transfer, which is visible in what they ship.
• Identity must be earned. Passport reputation across five trust tiers accrues from verified receipts over time. A copied tier system without accumulated history is an empty ladder.
• The claims are checkable. Release-blocking tamper rejection and the open ScoreCrux benchmark set a bar a competitor must meet in public, not in a press release.

A large vendor could do all of this. Doing it means becoming this, which is a different bet from bundling a logging feature.