approved service transitions to indicatorTrue. Invoking a non-approved // service transitions to indicatorFalse, and it can't leave that state until a // reset. The idea is that functions can "delegate" checks to inner functions, // and if there's anything non-approved in the stack, the final result is // negative. Finally, we expose indicatorUnset as negative to the user, so that // we don't need to explicitly annotate fully non-approved services. //go:linkname getIndicator crypto/internal/fips140.getIndicator...