I suspect we need standards/protocals defined at layers above the crypto-layer. For the certificate warning date, a yellow lock rather then giant red screens br

I suspect we need standards/protocals defined at layers above the crypto-layer. For the certificate warning date, a yellow lock rather then giant red screens browsers show me now would be good, so at least in some cases users can do the notification. However, the real solution is standardized tooling that helps the organization detect the issue. Let's encrypt is definitely in this vain, however I think it needs to be the point where software defaults to user friendly behaviors like auto-renewal unless explicitly told not to. This seems like it could be address in standards making process, but maybe that's the wrong venue.