I think we could get some kind of intermediate state though - Red is the expired/invalid cert, yellow could be valid self-signed (where you don't trust the issu

I think we could get some kind of intermediate state though - Red is the expired/invalid cert, yellow could be valid self-signed (where you don't trust the issuer), and green is fully validated trust.