Thomas Massie actually said...

"So, I think the zero trust architecture has merit."

"My final question, when it comes to security audits, it seems like it is not such a great idea to let the same vendors that are selling the software do the audits."

"Should we promote, allow, encourage, or should we discourage operating systems that do their own updates without user involvement?"

"I would appreciate that very much. Thank you."