Maybe the device owner only needs to be certified if the device was manufactured by a company that has had compromises or breaches in the past. That way, their

Maybe the device owner only needs to be certified if the device was manufactured by a company that has had compromises or breaches in the past. That way, their sales take a massive hit if they have a problem. That may motivate these companies to do something about security.