A distributed system might make sense. Build an API (could be a REST system with some basic conventions) that allows sites to vouch for the certs of certain oth

A distributed system might make sense. Build an API (could be a REST system with some basic conventions) that allows sites to vouch for the certs of certain other sites. The advantage is that you can then poll several sites to check the validity of a certain cert instead of being reliant on a single point of failure. Alternately you could use arbitrary key signing which the original site presented up along with their cert. It certainly seems preferable to the single-point-of-failure systems we have now.