I’m sure Apple has/will do similar. Isn’t the point of the cert not so much to vet the recipient but to create cost (including nonmonetary) to attain the cert a

I’m sure Apple has/will do similar. Isn’t the point of the cert not so much to vet the recipient but to create cost (including nonmonetary) to attain the cert and then have the ability to rapidly revoke the cert and nullify the malware installed base? Even if Microsoft makes some pretense of vetting, no one can ever perfectly weed out malware authors in advance, as that would require knowledge of their future thoughts and motivations (hard enough to assess those in the present). (If Microsoft has failed to revoke certs for known rootkits, by all means bash them hard for that.)