It would be really hard to keep everyone's browsers/operating systems updated with a list of certificates as they're generated and renewed. You pretty much hav

It would be really hard to keep everyone's browsers/operating systems updated with a list of certificates as they're generated and renewed. You pretty much have to concentrate it down to a small subset of trusted certificate authorities to sign your certificate. Also, it should be a way to verify that random people aren't able to get certificates on behalf of a domain they don't own (there's nothing stopping me from generating a cert for google.com - but it should be impossible for me to get it trusted by your browser).