I learned this lesson dealing with auditors many times. These people whose job really should be collaborative in nature (internally) still feel the need to find something, because if they don't, then their bosses say "did you look hard enough?"

So yeah, sometimes as we presented our security policies or documentation, we would highlight an existing problem for which we had a solution or proper executive backing to justify, so that when it was called out, we would haggle and then say "okay, let's fix that". Everyone had done their job.

Off-topic: I was blocked from reading that site using Proton's TX datacenters, but it worked as soon as I switched to Sweden.

Stop blocking VPNs, Rachel.