so if the closed source platforms are independently audited by DEKRA and verified by NIST CAVP cryptography, still hard to trust?