One of the heuristics built into us (because we're mortal beings living beings in a competitive, historically resource-poor environment) is that we trust the devil we know more than the devil we don't, and so unless there's a strongly compelling reason to trust autonomous driving devices a lot more than humans, there will be some inertia against using them, even if the calculations are that it will save X number of lives. I mean, inherent in that calculation is a level of uncertainty and people don't necessarily trust that number, because they don't have a reason to trust it, because they haven't really seen enough to trust it. Why take a company's word for it that it's safer when they have a financial incentive to do some creative stuff to get their marketing pitch? I would say that if you feel it doesn't reflect well on us, it's because it hasn't been thought about enough.
But a problem with cars is, usually ur malfunctioning calculator just harms u, but a malfunctioning car will affect people who don't agree with ur choice of driving non-zero failure rate self driving car.
So it is not a personal choice anymore.
An autonomous vehicle has an uncountable number of operating modes, and it is not feasible (perhaps not even possible) to test it in all possible conditions and states. Even if you could, doing so for (say) every single software change would take years each time.
Maybe that does mean that this is a fool's errand, and we just shouldn't be building autonomous cars, at least not until we have AGI that can think and act faster and with better judgment than a human.
I personally do think that "better record than a human driver" should be sufficient (perhaps with some significant, TBD margin; 0.1% better is probably not enough), but I accept and agree with your toplevel comment that sort of thing won't fly in the real world. The bar is really more like the self-driving car has to avoid making the specific kinds of mistakes and illegal/unsafe acts that a human driver would do (all while not creating new classes of mistakes that a human driver would not make), and, on top of that, be better than a human driver in situations where crash would not be deemed that human driver's fault.
What I want to keep reminding the software developers with consequentialist ethics is that the entire rest of the world operates under a totally different mental framework than the techno-utopian one. In that mental model, a self driving car is an appliance and it will be judged by the standard of all appliances, which is that any catastrophic failures that happen during their normal operation are evidence of a defective, untrustworthy product. The problem they're trying to solve and its complexity has little bearing in that judgment. What incentive does anyone have to be generous and forgiving about potentially fatal errors when you're not taking the consequentialist viewpoint for granted? That's the thrust of my observation.