I completely agree with his sentiment. While it certainly won't catch all vulnerabilities, it should at least catch the more obvious and easily exploitable ones. And it concentrates the skills required in an entity that has a business model that can sustain it.

I see it as analogous to FCC certification of RF related equipment.