Real-world SSL is broken above a risk threshold. There are far too many trusted CAs that have repeatedly demonstrated incompetence and all of them are beholden

Real-world SSL is broken above a risk threshold. There are far too many trusted CAs that have repeatedly demonstrated incompetence and all of them are beholden to governments. (There are far too many, period, or in the alternative far too few.) If you have high assurance requirements, SSL with commercial CAs can't be trusted. We have natural experiments showing that WoT, at least as implemented, doesn't scale. I hate that humans don't seem to be able to make it work, but that's reality for you. Yes, I am a security pessimist.