The root role lists the keys for all roles and is rotated through signed chains of root versions; targets signs hashes and sizes of the files clients may install (with delegations to other signers); snapshot fixes the versions of all targets metadata; timestamp is re-signed frequently so clients notice when they are being shown stale data. Clients follow a strict update workflow with version and expiry checks.
TUF secures Sigstore's trust-root distribution, Docker Notary v1 and automotive over-the-air updates through its Uptane variant, and has been proposed for package indexes such as PyPI (PEP 458). Its value is resilience: compromising one online key does not let an attacker push arbitrary updates.