I think Paul Kocher first published about timing attacks in 1996 (https://dl.acm.org/citation.cfm?id=706156). The fact that industry giants not only sold them, but got them certified says a lot about how much assurance CC and FIPS evaluation buys you...