Frustrating that FedRAMP is both a pain to get compliant with and also apparently is not a strong signal of actual security.

I see you've never worked in a compliance environment before.