> And I seriously question who signed off on certifying them Having a little experience with certifications and audits myself, I can't say it is terribly surpr

> And I seriously question who signed off on certifying them Having a little experience with certifications and audits myself, I can't say it is terribly surprising. Audits have a tendency to get caught up on things that don't really matter, and completely miss things that do. I imagine they showed auditors the testing and controls they had for releasing actual code, but didn't bother to explain how these "channel" files were deployed.