Understanding and Controlling Certification Risks