The entire premise of TLS suffers from the massiveness of the problem it's trying to solve. There are billions of users running 100's of varieties of web brows

The entire premise of TLS suffers from the massiveness of the problem it's trying to solve. There are billions of users running 100's of varieties of web browsers with varying levels of support and backward compatibility requirements trying to connect to millions of "secure" websites using a third party trust scheme involving 100's of certificate authorities across a profoundly untrusted network. The litany of attacks listed in djb's preso covers only the pure crypto based vulnerabilities. He doesn't even go into the fundamentally broken model of HTTP->HTTPS transition, the problem of any cert authority's ability to create absolutely any certificate without any central control, the social problem of browser users not really understanding the complex error messages and vagaries of the browser UI's indicating various levels of trust, the complexities of cert and key management for small and mid sized site operators and so on and so forth. Browser vendors' reaction to every problem seems to be to add yet another flag or HTTP header in the protocol negotiation phase and yet another acronym for site operators and users to get used to. I for one am not optimistic that we'll ever get to the level of "boring security" (not just boring crypto) that djb would like.