I do think the "drop it like it's hot" approach could work, but it would require browser vendor coordination, so that Symantic https stops working on all major

I do think the "drop it like it's hot" approach could work, but it would require browser vendor coordination, so that Symantic https stops working on all major browsers at the same time/day. And honestly, banks should have the expertise and resources to change certs in a day or two, and if they don't that's on them.