US security must start with zero trust