Certifying services in cloud : the case for a hybrid, incremental and multi-layer approach