If US government wanted us secure, they'd let us buy Type 1- and TEMPEST-certified gear that is strong enough to stop their pentests with minimal side channels,

If US government wanted us secure, they'd let us buy Type 1- and TEMPEST-certified gear that is strong enough to stop their pentests with minimal side channels, too. That's Defense-only. The stuff they recommend for rest of us are built on things like Linux which consistently has vulnerabilities, some of which they and foreign hackers use. I'd consider blocking foreign products that might be insecure if they'd: (a) Let me buy their secure products for same use cases. The WAN encryptors and Inline, Media Encryptors w/ trusted paths come to mind. (b) Start recommending, sponsering, and evaluating more high-security systems like they did under TCSEC. Especially covering the costs of the platform with open, permissively-licensed code so others have fewer excuses not to build on it.