I'd say to just get the word out. Around this time last year I was working at a security company and personally pushing for establishing automatic TACK protecti

I'd say to just get the word out. Around this time last year I was working at a security company and personally pushing for establishing automatic TACK protection for our clients, passively sniffing certs for SMB networks and learning which ones were good, but no one else knew what I was talking about, I couldn't convince them the project wasn't dead, and at the time I couldn't answer the question "how do we deal with a legitimate change in browser cert." If you can grok TACK better than I do at the moment, start writing patches for web servers.