A third-party library breaks chain of trust was my point. If you don’t have control over the code being used, you can’t certify it to be absolutely safe. This is something fairly essential when trying to prove your software to be secure. See the ‘xz’ fiasco from earlier this year.