A small nit: the DoD and NASA are two different customers who don't have to align on their risk thresholds. Just because NASA is okay with a particular risk, doesn't mean that the DoD should be. What I've seen happen in some cases is one side essentially says "That may be okay for them, but we don't trust their level of oversight and want it done our way." I would push back a bit on the "mostly certified" as being sufficient; you're either certified or you're not.
I've seen the paperwork argument cut both ways. It can definitely create a bureaucratic mess. On the other hand, one of the things NASA tries to drive is "risk informed decision making". Part of this process involves writing waivers when a requirement can't/won't be met to document what the new risk is (and they have to document that they find that risk acceptable). A lot of times, this process was dismissed at "just large amounts of paperwork" but in dismissing it, they made it very hard for decision makers to fully understand what the residual risk was. It was interesting to me that paperwork was used as an excuse to not commit to the process, but when it was streamlined, it still wasn't used. To me, that feels more like avoiding accountability than avoiding needless paperwork. This misunderstanding of risk is at the heart of most of NASA's spaceflight mishaps.
I wasn't aware of Garver's book, but thanks for bringing it up. Sounds like a good read.