>If Huawei is incompetent at managing OpenSSL in their codebase to the point that there are nearly 100 copies sprinkled through, most of which are vulnerable to

>If Huawei is incompetent at managing OpenSSL in their codebase to the point that there are nearly 100 copies sprinkled through, most of which are vulnerable to exploitation, that seems like a perfectly reasonable basis to bar their products for a number of years, regardless their nationality or other actions. Yes, and it also highlights that we need independent review of any code going into critical public infrastructure, no matter where it comes from.