Well ideally you get in early and catch it in a mandatory PR process, all PR's pass through EU devs who are the only ones who can merge.

Otherwise yes, security certification process to review existing code and then maintain as above.

As if certifications would prove anything. Just look at what the German tüv certifies secure. They are missing even the most basic XSS stuff. I have no hope here.