It's not about declaring things to be safe. It's about having documented and adhered to processes that show safety is taken seriously at every point in the design, manufacture and maintenance of safety critical systems.

That's literally the security industry and third party security assessments are routine in tech.

Yeah, but security industry is mostly a joke full of fraudsters. There are parts of it that work well, but most of it is theater and not that much competence.

Which is fine for low states they deal with and not fine with planes.

Having been in both in software/IT capacities, having done PCI certified software, medical device software (requiring FDA approval), no. Not even close.

MAYBE, MAYBE the insurance company assessments/audits are kind of related to what you are talking about. But not really. But not the FAA ones. They are such a different beast with so much brain power involved along with people with a combined centuries of experience in this stuff, it's hard to explain without being around it.

I thought FDA regulated device software certification was hard, PCI certification just annoying. FAA certification is on another level from those.

There's so many moving parts to aircraft certification honestly I was surprised when a new design would get type design certification. Which is why Boeing tries to do things like shoehorn in a new airplane under an older airplane type design (MAX) so they don't have to get a whole new type design approved.

That's what an (effective) audit is, conducted by technically-competent auditors. These do exist, and while some of their checklists include some bullshit, not all of it is bullshit when there are qualitative reviews of exceptions and of the soundness of processes.