&gt;<i>Much like the difference between forcing sites to hand over SSL certs and breaking SSL, there&#x27;s a gulf between compromising hardware that you have physical access to and compromising the software stack at the source.</i><p>You know that they could have their own programmers working there, or just approach, bribe or blackmail, an existing programmer to compromise the software (e.g. one found with child porn on his HD).