It is both. FAA establishes guidelines for planes and designs to meet, and the airlines (not just Boeing) are responsible for certifying and rating their planes according to those guidelines.
This is not simply a case of regulatory capture, the FAA simply doesn't have the expertise and in-depth knowledge to perform completely independent verification. Requiring the FAA to do so might be prohibitively expensive, so this arrangement is the result of pragmatic realism more than regulatory capture. It does require a great amount of trust between all partners though, and it seems to me Boeing has been more than happy to skirt their responsibility in this case.
The FAA delegate much of the certification to Boeing [1], and to me it seems either the FAA is underfunded, or Boeing was in bed with the FAA to push things through quicker.
The only reason the FAA delegates is because they could no longer pay a competitive salary to retain aeronautical engineering talent given the better pay in the private sector. So they delegated.
This completely missing the point of independent certification, validation, and acting as a proxy for the "customer of first resort" is the entire point of a regulator. If you can't sell an independently staffed regulator on your design, flying their own test regime, you shouldn't be making planes period. The new regime basically relegated the FAA to the role of paperwork auditor; a reactive instead of proactive regulatory process.
