Goes to show that you need to know/trust your certificate chain, and not some "padlock" piece of browser chrome. Continuing my irritation with the way browser

Goes to show that you need to know/trust your certificate chain, and not some "padlock" piece of browser chrome. Continuing my irritation with the way browser presentations de-emphasize the actual chain and certificates involved. Even if the certificate labeling is copied, the actual cryptographic values will change. (If they were readily reproducible, the cryptography itself would be useless.) So... notify the user when those values change from previous sessions, or at least when the fingerprint changes. This still assumes the ability to establish the legitimate values during those previous sessions or via other means. And it appears that trusting the original browser installation is not adequate. (E.g. dozens of "built-in" certs, some from who knows where. Or now, apparently, attempted forgery of Mozilla certificates.) Of course, I guess most users will refuse to deal with such details, anyway. Until it hurts enough...