Most of the time such reviews are not practical; they cost too much money and don't deliver results. Such review industries are almost always all about the rubb

Most of the time such reviews are not practical; they cost too much money and don't deliver results. Such review industries are almost always all about the rubber stamp and don't end up employing competent reviewers. See e.g. the Infineon ROCA flaw that FIPS certification didn't catch (even though that code reeked of them being too clever, and should've gone through proper cryptanalysis). See: flaws in the FIPS YubiKey (specific to that version! The certification requirements introduced vulns!) See: every audit of every terrible CA ever.