What is the simplest way to prevent a user that is able to certify to un-certify

This is another implementation that avoids hardcoded sign off states, but rather uses the workflow status to understand if the certification was done or not

'PREVENT CERTAIN USERS FROM UNCERTIFYING A WORKFLOW
'Perform the check only for the users belongig to a specific group
If brapi.Security.Authorization.IsUserInGroup(si, si.UserName, "CannotUncertify", False) Then
	'Check before the action happens
	If args.IsBeforeEvent Then
		'Intercept current workflow information
		Dim currWfInfo As WorkflowInfo = args.DefaultReturnValue
		'Check if the current step is a certification step
		If currWfInfo.CurrentStep.Classification = StepClassificationTypes.Certify Then
			'Check if the current step is completed
			If currWfInfo.CurrentStep.Status = WorkflowStatusTypes.Completed Then
				Throw New XFException("You do not have the right to revert workflow certification")
			End If
		End If
	End If
End If