Let's think rationally. Who can add to certify that your site is, indeed, yours? - First, hosting provider. They can say "yeah, that stuff's on our network". T

Let's think rationally. Who can add to certify that your site is, indeed, yours? - First, hosting provider. They can say "yeah, that stuff's on our network". There's IPsec, but no public keys float around, so it's only for VPNs now. - Second, DNS registrar. They can say "yeah, that's the domain registered with us". That's already invented and called DNSSEC, although browsers should query for CERT records. - Third, the notary. That's the current X.509 PKI with CAs. It is NOT broken, it's just insufficient and misunderstood. - Fourth, yourself. Self-issued certificates can be, in fact, highly trusted, if you met site owner personally and verified the fingerprints. Or they can mean virtually nothing, if you don't know their source. - Fifth, others. "We cooperate with those guys, they provide us nice stuff, everything works smoothly, and we trust them", "Been there, had everything I wanted, seen nothing weird, trust those guys". WoTs are extremely powerful, as they correspond to natural human trust networks. Implementation, is, of course, hard. Obvious part of solution would be to allow multiple signatures, so the trust diagram would be a graph, not a tree.