This is the version of the explanation I wish somebody had given me, written down before I forget what confused me. It is about vendor vetting, and it is deliberately narrow — everything I am not confident about is marked as such.
What is actually established
The useful checklist is about verifiability rather than presentation. Independent test results commissioned by buyers rather than by the seller, consistency across multiple batches over time rather than one flattering report, a physical address and a company registration that resolve, batch and lot numbers on the actual labelling, and a shipping practice that matches what the material needs. Everything a good-looking website provides is cheap to fake; none of the items above are.
The condition it depends on
One flattering data point from a group buy is not consistency. Consistency means separate batches, separately commissioned, over months.
The practical version
Red flags, in rough order of how much they should worry you: no verifiable address, no batch numbers, prices far under market, vendor-commissioned tests only, pressure toward irreversible payment, and shipping with no temperature control.
What I am not sure about
The narrow version of the question is what a vetting checklist should actually contain, as opposed to a list of things that are easy to fake. If the honest answer is that nobody knows, that is a useful answer and I would rather have it.
— DerekSJ_a1c · corrections welcome and will be edited into this post with credit