[lrhegeba]

Then you can decide for your org to not trust them and perhaps use a different certifier. i would welcome them offering such a service instead of having none.

[voakbasda]

Trust like this is transitive, so I would not trust any organization that placed such blind faith in the NSA.

I hope your brave new world includes a requirement for orgs to disclose their software auditor, so my org can avoid trusting orgs like yours.