That's why binary signature capability is important, and why very granular permissions are required. Any application that has even the capability to execute re

That's why binary signature capability is important, and why very granular permissions are required. Any application that has even the capability to execute remote code should be precluded from getting the best ratings, and come with a disclaimer from the ratings company. It's hard, and people will try to game it, but at least you have a company that is incentivized to try to solve the problem because it actually matters if they do a bad job, instead of a monopoly (within that market) doing so with almost no repercussions if they do it poorly.