The only solution then is not to sell them at all because a government that can't gain the tools directly will simply set up a blind to do the procurement and there is only so much research you can do on your customers before you start to lose money on a sale.
I don't agree that that's the only option, but I think selling offensive security technology is so complicated and fraught that I'll never do it myself. So, "don't sell to governments" is definitely one viable option.
