[davidgerard]

see my longer comment, we haven't found it hard in practice. Mostly it's about technical debt.

The actual threat model is that you need to show you take this seriously.