@dalias the problem space goes deep. While we are talking radical ideas, it makes little sense that your anchor for e.g. TD.com being your bank is the fact that they pay a nominal sum to CSC Global and Verisign therefore maintains that the site points to them. One wants a stronger anchor that could prove it's your bank regardless of DNS, but the UI and frankly the social infrastructure to tie that up failed in EV certificates and remains unexplored otherwise.