How about only apply to non-FOSS software? Most hobby projects used not just by the author altend to be FOSS, and businesses can decide to go FOSS, making their software independently auditable by anyone, or go through certification.
I guess there’s a danger of a campaign to re-brand FOSS as “uncertified” then…











I kinda wish we could federate jellyfin instances. Just manually, with friends I trust. Would instantly expand everyone’s catalogue.