Parts can be commercially available but still export controlled, which appears to be what's going on here
It doesn't take very many steps to make tracking sales untenable.
https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
>As of 2009, non-military cryptography exports from the U.S. are controlled by the Department of Commerce's Bureau of Industry and Security. Some restrictions still exist, even for mass market products, particularly with regard to export to "rogue states" and terrorist organizations