Where do I admit this? About fines? Yes, fines don't work.

Yes, about fines. From your post: "Ah, yes, fines for companies are not enough. I agree."

they would lose 100% of revenue.

We can't get the government to enforce this when tens of millions of records are leaked publicly, this absolutely will not happen for failure to report a vulnerability. If you have any idea of how to make it happen, please, lets immediately apply it to breaches and then figure out how to apply it to failure to report vulnerabilities.

We just need agreement on the certification globally.

As far as I am aware, there is no certification (one which is legally required to obtain a job) on the planet that is globally recognized. But I would be happy to be proven wrong here.

but we don't need agreement on the punishments globally.

Which will end up with some countries not willing to charge 100% loss of revenue, causing a mass exodus of companies from any country which does charge 100%, thus making the solution untenable.

ICANN is an interesting example, but it's not a certification. The scale (and thus administration, compliance, etc.) is very different.