In the meantime, for SSL on team projects which are not yet released-to-the-public, there is a web-of-trust certificate issuer called CAcert.org which can be in

In the meantime, for SSL on team projects which are not yet released-to-the-public, there is a web-of-trust certificate issuer called CAcert.org which can be installed on relevant machines and used. At one point they were trying to pass an audit and get into Firefox, so perhaps someday they can become a default for web browsers. If they cannot, then perhaps a sufficiently motivated group could set up a similar authority. Ideally, the flow would be much simpler than even CACert has made it; you ask for a certificate for drostie.org, the CA does a WHOIS for the administrative contact for that domain; the CA sends an email to that domain name containing a link to confirm the request; if you visit the link then you can upload a public key and perhaps even generate a private key (via client-side javascript, of course -- you don't want to send such things to the server). I don't know whether you could make it pass a security audit and get into major browsers -- but I like the idea that this could be much more user-friendly than it is.