Not the point. The point is that nobody who doesn't know him knows whether he can be trusted, and the ISO itself might be prepared on a compromised machine unintentionally. This is very much a supply chain issue.