Jason,

I'm not sure what (or if) you're disagreeing with any of my points. PCI is clearly a complex issue in many regards but doesn't the outsourcing merchant have a pretty easy go of it?

Did I miss something? It's certainly possible - I don't claim to be a security expert and I don't want to be passing bad information.