The Problem with Vendor-Driven Certification Schemes