"$600k is a lot of money to implement an existing standard." Not if such a requirement includes things like FIPS validation, which is entirely possible in this

"$600k is a lot of money to implement an existing standard." Not if such a requirement includes things like FIPS validation, which is entirely possible in this case. Plus, in some cases, these things are done in liu of donations, etc. I can think of plenty of cases where well known contractors on open source projects have been paid very well simply as a way of showing support for that project.