in security design you already assume everything is untrusted until proven otherwise, most trusted components are limited and internal, and whatever external “trust” exists is limited to the bare minimum