They should at least wait for DANE + DNSSEC, which is a tangible (and free) alternative to the CA system, even though it would still be quite a bit of effort.

They should at least wait for DANE + DNSSEC, which is a tangible (and free) alternative to the CA system, even though it would still be quite a bit of effort. I'd be curious to know how this would affect local servers in the intranet. Surely we wouldn't want to have to start issuing certs for everything inside the firewall as well? I think this is a bit too shortsighted of a bug report. Anyways, since this is not an official proposal, I think it will just be closed as invalid by Mozilla.