Your point about the government taking advantage of a slippery slope is excellent. The OS vendors may be too powerful of a group (investor pressure can make them do things that wouldn't be considered benevolent). Perhaps third-party providers would be a better solution. At least then there would be a chance of responding to market pressure to be good.

We would need some way to verify that our computers were "clean." Without this certificate (or whatever), we wouldn't be allowed access to web pages or http ports. But we would be free to get the cert from any vendor we could.

Even with this method, there is a vulnerability to spoofing the certificate.