...and every 2-bit charter operator and flying school and aeroclub then has to have some sort of approved security check scheme with appropriate security around the details of the scheme and DOTARS audits and training and responsible persons and annual reporting and Strict Liability and headlines like "Country Flying School trains terrorists without security checks. Flying instructor arrested".
Screw that.
The majority of them are flat out keeping their AOC, and that's something they're actually qualified to do, without handing them National Security on a self-serve platter.
Keep it central and Govt-controlled, just dial it back to "sensible" and "risk-related".