Address high-pri CPE auth findings

[mattroe]

CISA finds: https://docs.google.com/document/d/1diaZQF4c424MqY7VfqXSyRWqQPjKANKCZFgvwn_lW7U/edit?usp=sharing

[arsalansufi]

We've addressed all the listed high-pri finds, but one, which we've not been able to get clarification from CISA on. Without that context from CISA, we'll need to conduct a deeper investigation of our own.

@benadida and I agree that it's not critical for us to complete that investigation before cert submission and can push to v4.1.

I'm ticketing that final follow-up separately accordingly: #5574