I do not consider myself particularly tech savy, and I marvel at how the IT group at my firm controls and protects the information we generate for our clients and friends. So I cannot answer the questions I have posed above. But someone at the CPSC had better ask them, and get answers soon. As the organization that is charged with protecting the public from unreasonable risks of injury or death (albeit from consumer products), the integrity of the information coming from CPSC is critical.
Commissioner Dana Baiocco said that the CPSC recently issued "guidance" on masks and other other pandemic products, like gloves and disinfectants, but she doesn't know who is responsible for publishing it.