Browsers do implement pinning via HPKP, every site can use that and it adds a trust on first use protection. It is not deployed widely yet, but that's not the f

Browsers do implement pinning via HPKP, every site can use that and it adds a trust on first use protection. It is not deployed widely yet, but that's not the fault of the browsers. People need to start using HPKP if they're worried about CA failures. Also there is another effort to fix the greater CA problem called Certificate Transparency. The idea is to have publicly verifiable logs of all certificates. It is not fully deployed yet, but it already helped to uncover misissuances of certificates. Appart from that the policies for CA operations are much clearer and stricter these days. I've recently written a 2-part article for LWN about all these issues: https://lwn.net/Articles/663875/ https://lwn.net/Articles/663875/ https://lwn.net/Articles/664385/ https://lwn.net/Articles/664385/