> And then the whole thing is really terrible security theater as you are technically out of certification if you apply any non-inspected updates. The days whe

> And then the whole thing is really terrible security theater as you are technically out of certification if you apply any non-inspected updates. The days when FIPS compliance required using relatively weak ciphers and modes were lamentable. But all the other tedious box checking work arguably shows that cipher bike shedding is the real security theater. If you don't have a plan--and follow that plan--to track software origins and updates, or an ability to quickly resolve dependency issues that make it difficult to refactor or even update your systems, then you have much bigger problems than whether your latest software is using the Noise protocol or has migrated from BLAKE2 to BLAKE3. Which is not to say that maintaining FIPS certification or FedRAMP compliance equates to good security. It's trivial to identify simplifications that would result in better operational security. But the vast majority of projects and organizations struggling to meet those standards are struggling precisely because their security posture is horrendously poor when looked at comprehensively.