How do you validate that a thumbdrive sent to you is actually from the vendor? Is that really more secure than a properly encrypted OAT update? Security has lots of blind corners.