The idea is that the browser would only accept signed certificates, and only those certificates which the signing authority has not revoked. So long as the sig

The idea is that the browser would only accept signed certificates, and only those certificates which the signing authority has not revoked. So long as the signing authority is in a trusted list, the user would see no Yes/No option at all. It would simply install, or be rejected outright with an explanation of why. It would be like limiting web browsing to HTTPS only, except you would not be given the option to click through for unsigned certificates.