Listen
The original requirement behind this function was that the controller should be able to filter certain persons (groups), in this specific case only the controller's own known employees. All other scans should be discarded.
The whitelist function just refers to a different way of processing. The routine does NOT bypass the certificate check as such! This is important for understanding the whitelist functionality.
The blacklist filters all applicable people and denies access no matter what the outcome of the certificate check would be.
The order of the queries is blacklist -> whitelist. The blacklist always has priority.