Because the entity doing the certification has access to the source code (if the certification is worth anything at all) and if you really do not trust the cert

Because the entity doing the certification has access to the source code (if the certification is worth anything at all) and if you really do not trust the certification body you can usually just pay extra for access to the source code without distribution rights and do it yourself. For instance, even Microsoft has the Shared Source Initiative [1] which allows qualified customers access to their source code. [1] https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/