That would be a start.
Second, any computerized device must pass FTC/FCC/UL (pick one) tests for computer security before going on sale.
There's more that can be done, but let's go after the simple stuff first.
I don't need ISPs to mess with my connection any more than they do already.
In a recent attack there were 145607 devices sending >1.5Tbps[1]. That's a lot from individual connections.
(From: https://twitter.com/olesovhcom/status/779297257199964160 )
Even so, this one wasn't a particularly sophisticated attack. Even if we could weed out this particular type, many a DoS rely on amplification or asymmetrical computational cost with respect to the size of the request. So if we concluded that 1.4 MB/s of HTTP or DNS or plain TCP were a lot and managed to block these senders, it would be far from a universal solution against DDoS originating from domestic hosts. And there's reason to believe we'll see much larger botnets unless manufacturers of IoT devices start taking security seriously. So tomorrow 0.14 MB/s per home could be plenty.
What cost would this blocking incur? How often would I have to call my ISP because they blocked perfectly legitimate traffic? Unfortunately maybe not that often, because after the first few calls I'd probably figure that they are too big to give a shit about my problems.
Similar with lead free solder.
But if we wait 10 years, it'll be too late, and we'll have killed the internet or given into draconian measures to stop the problem - which is what none of us want.
Frankly, I don't even care if a given government has great security review - as long as they put a process in place it's a start that can be improved upon.
Manufacturers don't need to keep a credential database, as legitimate users can simply look at the label.