The difference though is that if we used web of trust / PGP, you still have the choice to divert around exploiters. With PKI, you can't choose the root CAs. To

The difference though is that if we used web of trust / PGP, you still have the choice to divert around exploiters. With PKI, you can't choose the root CAs. Today, Verisign abuses the shit out of their market dominance to price gouge certs, and I have no reason to ever trust that company with anything, they don't give me a reason to, and they almost certainly have their root keys in the pockets of groups like the NSA. So if I don't want to run my WoT through Google, I could choose not to. For the average user they shouldn't care, but I would at least have the choice. Right now there is none.