A security certificate names one build. A fleet runs a stream of them.
Common Criteria paperwork is turning up in device tenders as though it closed the question. It closes a narrow one, about software that stopped existing on the day the lab finished, in a configuration the vendor scoped itself.