i agree about the power concerns, but where would you assign the authority if not the app store?
This is the kind of thing government regulation is useful for, when it works.
In practice they delegate certification to a legacy and expensive certification authority