Wouldn't it be great if some (smart, enterprising, generous) person could produce a browser extension to leverage these approaches for those that might find typ

Wouldn't it be great if some (smart, enterprising, generous) person could produce a browser extension to leverage these approaches for those that might find typing "openssl s_client -connect..." into a UNIX prompt a little bit much? Another idea: Schneier writes: http://www.schneier.com/blog/archives/2011/03/comodo_group_is.html http://www.schneier.com/blog/archives/2011/03/comodo_group_i... "The safest thing for us users to do would be to remove the Comodo root certificate from our browsers so that none of their certificates work, but we don't have the capability to do that." You certainly can do it manually (as one of the comments explains) but a sweet program that targets system keystores (Windows, Java, Mozilla, Chrome, Safari, any more?) might be a nice little project. List of configurable CA DNs to remove? Regexes? Whitelist? Zap that "unknown origin" mozilla cert whilst you're there perhaps? I don't have bandwidth, these thoughts are free to steal :)