Downside to security standards: when vulnerable is better than uncertified (randomoracle.wordpress.com)