On: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

[ivlad]

Doesn’t certificate verification occur in PrevSep process? If so, this would only grant RCE with nobody’s privilege.