And ALSO interesting is that this paper is advocating that contracts between software companies could make more use of existing technology certifications to establish liability...

... existing certifications like FedRAMP...

... FedRAMP that requires using the NVD... and... 😳 *maybe* that's not the best example of something to encourage more use of, right this second 😬

cc @joshbressers