I think you could make the alerting louder. Hire an independent auditing firm and create some contract around what to do if they fail. A closed source client i

I think you could make the alerting louder. Hire an independent auditing firm and create some contract around what to do if they fail. A closed source client is fundamentally incompatible with the claims they want to make.