Well, really we pay CAs for authentication, not encryption. Your computer can encrypt just fine on its own. Most of the solutions I've seen to this problem are

Well, really we pay CAs for authentication, not encryption. Your computer can encrypt just fine on its own. Most of the solutions I've seen to this problem are done in one of three ways: 1. Create better tools to monitor for abuses, ie. Google's new DNS-accessible SSL repository or Perspectives. 2. Tack on trust-on-first-use, ie. SSH or CertPatrol. 3. Make industry-specific root CAs that self-regulate, ie. a financial services CA with browser chrome that displays finance-specific info. Then the SSL observatory can play each root off eachother with comparative stats.