One of the most important things that could be done is for browser vendors to change their approach to self signed certificates. At the moment it looks like a d

One of the most important things that could be done is for browser vendors to change their approach to self signed certificates. At the moment it looks like a disaster when you visit a site with a self signed certificate, and certainly no reputable business would do it. However given what we know about how compromised certificate authorities are likely to be, I actually now consider a self-signed certificate as more private than one signed by a CA. I would much rather everyone signed their own certs and we use pinning and other, more decentralised strategies to track authentic certs than any kind of centralised model.