This is a neat idea, but we really need to define a standard for self signed certificates. Something like certificate pinning should be mandatory. It should be

This is a neat idea, but we really need to define a standard for self signed certificates. Something like certificate pinning should be mandatory. It should be done in a way so there is no confusion with a connection with identity protection but at the same time it is essential that the user knows they are at least getting the protection of the self signed certificate. Perhaps we need something like a httpq:// resource identifier. For bonus points such a standard should incorporate a web of trust system that can not be overridden by a bogus certificate in the regular system. Ideally a self signed certificate provided by someone you can physically visit should be more secure than what we have now. Added: I guess my point is that we are thinking about this backwards. A verified self signed certificate is the gold standard, not some inferior alternative. I should be able to walk into my bank and then walk out with a certificate on a USB key that can not be messed with. If we are going to change things we should strive to end up with the possibility of something better than what we have now.