"The problem is that we are forced to trust a particular CA because the company we are dealing with chose to buy their certificate from that particular CA." Th

"The problem is that we are forced to trust a particular CA because the company we are dealing with chose to buy their certificate from that particular CA." That's why maybe interesting to make the current approach symmetric: Create a "CA assurance" layer, which would consist of a business entities who would sell the CA reputation validation services. The product of their business would be the list of CAs to trust (to be realtime-updated into the browser), they would collect a monthly fee, and would be insuring their users up to amount of $$$ in case one of the CAs on their list screws up (or not, depending on their SLA). This would create a system with two components - on one side "CA reputation services", on the other hand - "CAs" - watching each other and being vigilant, in an effort to not lose their respective customers. As soon as there is no monopolies, I think this approach could work - and relieve the browser vendors off making the tough decisions. They can still keep the list of root CAs, but just have them all "off" by default - so that the tech-savvy could make their own decisions, and publish their own lists, if they want to. The "CA assurance" layer would actively fight the attempts to create the monopoly in the CA side (because then they'd be out of business) - and the CAs should not be able to affect the "CA assurance" segment since the entry barrier there would be quite low. This approach still does not solve the "CA sunrise" problem - making it more difficult for a new CA to enter the market. (But maybe that is a good thing ?) EDIT: however, what this approach would address is the "local trust" issue: the said mom and pop shop can very well be trusted by the locally-significant CA assurance service, and not bother with the worldwide paperwork at all.