But they'd still be competing with Silicon Valley for top-end developers, who are going to be asking for a salary equivalent to their skills. You might save a little once you factor cost of living adjustments, though you'll also have to offset that with increased difficulty in finding the right person.

Folks who know security well enough to do this correctly are rare. You don't want to farm out critical X.509 infrastructure to the lowest bidder.

What do Verisign, RSA, Comodo and GlobalSign have in common? Not being in SF.

I didn't say you had to be in SF. Just that you'll be competing with SF for talent.