I think this opens bigger questions on who and how people get access to these capabilities. After that recent cold wallet physical supply chain take over, what sort of people are able to get certs for anything they need?

eMudhra is primarily used by the Indian government, so not hard to infer how they got into allowlists.