Do you think the statement “If we adhere to our secure design principles, we will deliver secure code” is both necessary and sufficient?