You're completely missing the point; this isn't about technical protocols, nor is it about minimizing trust. I can choose to agree with Mozilla or a root CA[1].

You're completely missing the point; this isn't about technical protocols, nor is it about minimizing trust. I can choose to agree with Mozilla or a root CA[1]. Trusting intermediaries does not necessarily involve transitive trust. Someone that trusts Mozilla does not necessarily also trust a 3rd party simply because Mozilla trusts them. Mozilla cannot simply force anyone to trust a 3rd party by fiat, and attempting to do so (such as in the current situation) can easily be seen as a betrayal. [1] re: root CAs and "trust the people they issue certs to" - that isn't how the current PKI system works. The CA is only vouching for the validity of a certificate. Trusting a CA's claims about the identify of the other end of a SSL connection is orthogonal to the trustworthiness of the 2nd party at the other side of the SSL socket.