The third option is to pay someone else to certify things (maybe the developers of the thing, or a third party entirely).

The problem gets out if people find out “Caddy is certified by Google” and then don’t bother doing their own.