yup, and e.g. 802.1x has required an explicit trust anyway, which is a moving part that can break