Perhaps require that certifying commercial software as CE entails publicly certifying all the individual OSS components as CE as well.