@hughsie reminds me of https://infosec.exchange/@_r_netsec/116397571134177459 maybe that can help take out the false negatives?