There must be a further vetting process beside whether or not an open source library has contract support requirements. Otherwise GOV developers could just pull

There must be a further vetting process beside whether or not an open source library has contract support requirements. Otherwise GOV developers could just pull some Chinese student's OSS encryption library for their next VPN project... Oh wait, there's FIPS. This blanket statement you've made isn't very meaningful.