> You may be right, and perhaps it would be better to relax the requirements, letting them flow from the critical software (PII, risk to life and limb) downward

> You may be right, and perhaps it would be better to relax the requirements, letting them flow from the critical software (PII, risk to life and limb) downwards. agreed, I think this would achieve a lot of the positive downstream effects without placing an undue burden on developers of less critical commercial software. to go back to the desktop app example, it probably needs to authenticate serials for authorized users. you could write a small self-contained auth server and have it certified, while continuing to ship your behemoth desktop app that can't be fully evaluated.