By law, the certifiction activities done by the EASA (I assume the FAA is the same) cannot be done by third parties. It also worth noting, that the aircraft certification procedures worked pretty well for decades, up until Boeing started to lie to the FAA. Not sure how Boeing kept its design org approval after that.

EDIT: Some required activities by the organizations to be certified can be outsourced to third parties, the org itself is still accountable.

> Not sure how Boeing kept its design org approval after that

That's an easy one. It's too big to fail. One way or another Boeing had to make it out the other end of the 737 Max disaster intact as an organisation. Anything else would have been unpalatable from the point of view of the American military industrial complex. I know that phrase is usually applied in a derogatory way but here I don't even disagree with the thinking.

That seems to be the answer. And I kind of get the reasoning. Under EASE rules, there are accountable people at the head of approved design and production orgs. I hope those people at least got their licenses revoked, if something similar exists under FAA rules.

What could possibly go wrong?