[jcranmer]

There's a historical story that's relevant here. In the building of the Brooklyn Bridge, the contract for steel cable was let to someone whose reputation was such that the engineer insisted that all of the output tested for quality, and none of the bad cable was to be let installed on the bridge. Yet almost all of the bad cable made it onto the bridge, because the contractor did a good job of figuring out how to frustrate all of the compliance and inspection procedures for the cable.

That's the hard part of supply chain vetting: trying to ensure that your contractor isn't trying to pull the wool over your eyes. If you think "a plane trip and a few days of a couple people's time" is going to be sufficient to actually ensure that you're getting responsible cobalt, well, I have a bridge for you.