Chances are that the contractual arrangements that routinely exist between governments and contractors like Gemalto make "blameless post mortems" non-profitable. It's a tricky thing to do right, because you do want to have accountability in the contract.

Governments (rightly) want contractors like this as experts-on-tap in the technology under consideration. But what you really want is not exactly a provider of the technology, but rather an advisor or partner in the process of implementing your process. I don't think we know how to structure a non-nepotistic relationship of that kind.