It doesn't have to be a perfect process, or even one that's "feature complete" when it launches. It just needs to be something people can latch on to. Like if

It doesn't have to be a perfect process, or even one that's "feature complete" when it launches. It just needs to be something people can latch on to. Like if a previously certified device is found to be full of holes because of a new attack vector, that vendor can be forced to address that issue or lose their certification. Right now the consumers have no recourse other than an ugly class-action lawsuit.