I like that idea, or at least contract a private company to do the pentest. That makes it government-sanctioned and pushes the responsibility back onto the peop

I like that idea, or at least contract a private company to do the pentest. That makes it government-sanctioned and pushes the responsibility back onto the people who run the services in question, so we never have to guess about whether it's negligence or ignorance. Are there any wider implications whete security doesn't get taken like we expect it to as a result?