Probably need to look at hybrid models - trusted clients that offer some verification. Or some organizations that audit. Maybe some economic penalty (worked into the UX somehow). Even then, at scale there will likely be gaps where no one is watching and people are installing carelessly.