The major flaw with that proposal is that the government has shown itself to be exceptionally incompetent (just like everyone else) when it comes to security.

The major flaw with that proposal is that the government has shown itself to be exceptionally incompetent (just like everyone else) when it comes to security. For example, the NSA's security -- not some underfunded, minor agency, but the NSA itself, the world's leading cybersecurity agency -- has had its security breached on a large scale basis, multiple times. And that is just the beginning of the very long list. It's not unique to the US, either; other governments are the same or even worse in terms of security. Given that government cannot even create working policies to secure systems that it directly controls, even in agencies with practically unlimited budgets and the strongest possible security mandate, how on earth can it be expected to create policy for anyone else, to supervise systems it does not even control, for commercial users with tiny or no budgets? Issuing nice-sounding legal regulations that say 'go forth and be secure' will accomplish nothing.