1. A method including the following: at a certification authority, receiving an executable program generated by a party independent of the certification authority; at the certification authority, testing the executable program and, based on the results of the testing, generating a specification describing the actual operation of the executable program; at the certification authority, generating a digital certificate certifying that the executable program operates in the manner described in the specification; receiving the executable program at a user site; receiving the digital certificate at the user site, the digital certificate specifying a security level; at the user site, evaluating the digital certificate to determine (a) if the digital certificate is associated with the executable program, and (b) whether to execute the executable program, said evaluation including comparing the security level to a required security level; and at the user site, executing the executable program, the execution being dependent on the evaluation of the digital certificate; wherein the user site includes a tamper-resistant execution space, the tamper-resistant execution space being operable to protect against tampering, by a user at the user site, with the performance of said step of evaluating the digital certificate.