@tychotithonus I think this dilemma is equivalent to the USGOV vs. Kaspersky case. After some point you have to trust your supply chain. If that's not reasonable, you cut ties.
(I know this is not an answer, but my gut tells me this isn't really a technical problem to solve)