Agencies are talking zero trust, but will they put the money behind it?