I did some work in this space. The cert authorities were never really designed to be a backstop against phishers as that threat really rose up in prominence aft

I did some work in this space. The cert authorities were never really designed to be a backstop against phishers as that threat really rose up in prominence after they were setup. And it placed them in a weird gatekeeper role. As designed, it was supposed to be that: Domain Validation (DV) certs would indicate that your connection was secure. Extended Validation (EV) certs would indicate that your connection was secure and you were connecting to the proper site. In reality, the problems with phishing and mis-issued DV certs got so bad that that issuers like GeoTrust (owned by Symantec) began keyword checking DV certs for major company trademarks, phishing targets, etc. that depending on what it was would put your through varying degrees of scrutiny. Examples: - Some used bookstore had a domain like "the-good-book.com" which got flagged for manual review b/c of the "book.com" string and so many "facebook.com" phishing attempts. - Anytime people would request certs for BMW, HBO, would trigger requests for contact information within those organizations and often a phone call from GeoTrust - It was basically impossible to get anything issued with the term "paypal", "bank" or "apple" in the domain. Please note that these were all for run of the mill - $15 single domain, DV certs. This was for a fairly high end service that required credit card accounts, etc and we still saw around 5% of requests get pulled (rightly or wrongly) into one of these manual review filters. It was a fairly unsung and unappreciated part of the what the cert issuers were doing - but it absolutely 100% helped. LetsEncrypt is forcing the Cert and Browser industry back to the original DV/EV split and it's unclear where we're going to land. Right now even technical people _trust_ the green lock and it's wildly easy to miss the fact that you're on a domain that is paypal-login-security-usa-1.com I think we're going to see a future where the browser indicators are: Red -> No SSL Gray -> DV SSL Green -> EV SSL