1) Hydra is deployed at scale, Oathkeeper is our new kid on the block

2) We have an OpenID Connect certification coming in, but no security audits so far