1. So there was no certification of the certifiers?
2. This is stupidity that rises to the level of being malicious. There is no excuse, this was a fraud. Their business was literally to promise security and.. make a profit. Nothing was ever delivered.
Like a web-of-trust model?
> promise security and.. make a profit
Some would argue the inherent moral hazard makes these opposing outcomes that cannot be achieved simultaneously.