I think the point is if a cert is suddenly from an untrusted source it's a sign of malicious activity, hence the increased negative feedback to the user relativ

I think the point is if a cert is suddenly from an untrusted source it's a sign of malicious activity, hence the increased negative feedback to the user relative to an insecure connection. Granted this opens up attacks like ssl stripping, https://github.com/moxie0/sslstrip https://github.com/moxie0/sslstrip, but certificate pinning is making that more difficult.