Many companies falsely believe OTP makes them secure. A service that systematically tests implementations for known vulnerabilities would provide real security assurance. Charge per audit to financial and government clients. Start with basic script testing.
Legal risks of security testing.