We detached this subthread from https://news.ycombinator.com/item?id=12255106 and marked it off-topic.

Paying for certification is what's required. Governments require various certifications to sell to them, and that certification costs money in consultancies. RHEL paid for the testing, they get a certification and access to the customer.

It looks like this is probably referring to EAL [1][2].

In a market with a large number of vendors interacting with a large number of relatively unknowledgeable buyers, an oversight team is going to try to find a certification to give guidance (and ass covering).

Yes, this is a barrier to entry, but it's also a learned behaviour as buyers get repeatedly burned.

I would argue that this is equivalent to requiring your plumbers and electricians to be licensed.

[1] https://en.wikipedia.org/wiki/Evaluation_Assurance_Level [2] https://www.redhat.com/en/about/press-releases/red-hat-achie...

It's easy to see conspiracy everywhere, but the truth is usually much more mundane. It costs a lot of money to security-certify an OS, so they probably only wanted to certify a small number. Windows is obviously the most-used desktop OS for PCs, so that seems the logical choice.