You can have a zero trust model, but you can’t truly have zero trust