The issue at hand matters far less than the issue that the issue at hand is part of, which is the CA system itself. With the CA system, you have a two tier thre

The issue at hand matters far less than the issue that the issue at hand is part of, which is the CA system itself. With the CA system, you have a two tier threat model where the mighty and powerful can have all seeing eyes and the consumer is told that all their https communication is secure and private. Certificate Transparency and other proposals may help fix this, but the first thing to do is to acknowledge that there is a problem, and so far the major players have yet to acknowledge the fundamental problems of the current CA system. LetsEncrypt makes it worse by promoting the wider adoption of this flawed system. Certainly won't help keep us secure against the Chinese or anyone with big resource. Update: Stating that there is no solution without any knowledge of the existing solutions is itself part of the problem. Let's start with this: https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain