I'm not sure I follow, or understand the goal. Are you suggesting that we drop all other CAs in favor of AOL as the sole root CA? The fundamental problem in m

I'm not sure I follow, or understand the goal. Are you suggesting that we drop all other CAs in favor of AOL as the sole root CA? The fundamental problem in my eyes is that of hierarchical, transitive, one-way trust. Take the Chinese government CA, for example, though any root CA that any user distrusts for any reason may be substituted. We don't have a web of trust, where my distrust of the Chinese government can be indicated and influence the measure of trust afforded, or where I can revoke my computing platform's implicit trust of the Chinese government. I might not trust their intentions, or I might not trust their security invulnerability. If you are suggesting that AOL becomes the sole CA, I see how this clears a lot of bad stuff, but I'm not sure how it fixes anything. You seem to want to me trust AOL, but maybe I don't. Furthermore, I may trust them today yet have concerns that absolute power corrupts absolutely. HTTPS design depends critically on absolute systemic integrity -- like a benevolent monarchy, it's great when it works, but a single failure to exclude malicious entities is presumably and likely fatal, at least as regards design's intent. The system keeps "working" without meeting its goals, and any security system that does this is actively harmful and is better off halting.