Doesn't the embargo end when the CVE is published? I thought that's the whole point in CVE allocate != CVE publish.