The problem with that idea is that PCI compliance doesn't just include the software you're running, but the infrastructure you run it on, various elements of organisational security and, of course, certification costs.