I think what we're seeing are the same sorts of things that led to building codes, fire codes, licensing of architects and civil engineers. After so many building collapses, bridge collapses, or disastrous fires, people finally demanded that "build whatever you want, however you want" is not OK if you are making something for use by the general public. I think ultimately we're going to see legislation requiring licen…
It might happen but I don't think it'll work. Codes work because they deal with known, predictable, and repeated problems. You can keep improving the fire code with each disastrous fire and fire will not actively try to outsmart you next time. Security OTOH is anti-inductive because you're dealing with intelligent attackers adjusting their methods. In this environment, security code and certifications will just becom…
How about this: Did you test your code for buffer overflows? If not, you're negligent.
Maybe you need to submit an affidavit that the code has ben tested, a log from an outside testing service (similar to a building inspector, but for code quality), or some other step to verify that something has been done. For the record, building inspections have flaws, too, but they sure help in spite of those issues!
Many other ideas, but that one is simple to communicate.