The usual rejoinder to the funding capture problem is that organizations will still have to act to in order to stay meaningful and important. If an organization does nothing, outside people will come to see it as unimportant, useless, and meaningless, resulting in the people funding it winding up not getting anything for their money, so they'll stop paying. After all, why pay for something that gives you no benefits?

(Let us skip lightly over all of the practical difficulties here, starting with organizational inertia.)

However nice this rejoinder is in theory, it does not work this way in practice. The problem is that the organization does not have to actually be important, it just has to market itself as important (to both consumers and to its real audience, would-be and current sources of money). Since looking like you are doing things is often much easier (and cheaper) than actually doing things, the organization rapidly devolves from taking actual action to clever marketing, doing PR exercises, and if forced, doing just enough to look good.

Hence such things as TRUSTe. It doesn't matter that TRUSTe's mark is effectively meaningless (and laughable in certain circles); what matters is the marketing that persuades people that it still means something.

(Applications to SSL certificate issuers are left as an exercise. I don't think they're in the same boat, but it's certainly a closely related one.)