But they'd still be competing with Silicon Valley for top-end developers, who are going to be asking for a salary equivalent to their skills. You might save a little once you factor cost of living adjustments, though you'll also have to offset that with increased difficulty in finding the right person.
Folks who know security well enough to do this correctly are rare. You don't want to farm out critical X.509 infrastructure to the lowest bidder.
