This is the kind of thing government regulation is useful for, when it works.
In practice they delegate certification to a legacy and expensive certification authority