To be fair: that's completely by design. S/O was a direct reaction to the perception that the perpetrators of the Enron and Worldcom scams were essentially unprosecutable because of the difficulty of proving their knowledge of the events. So the new law puts the presumption of knowledge onto the senior executives via the certification requirement.

Now, one might argue that this is bad, or has unintented consequences. But it's not a surprise. It's the intended effect. If you lie (even, perhaps, unintentionally -- though I don't think there's been a test case of that yet) on your company's financial statements in the modern USA, you are a criminal.