Trustworthy entities (e.g, Mr Schneier and Krebs and whoever they trust) could just offer a signed list of pub-key - identity pairs which can be stored in the b

Trustworthy entities (e.g, Mr Schneier and Krebs and whoever they trust) could just offer a signed list of pub-key - identity pairs which can be stored in the block chain. The amount of work needed should be pretty low, they start with the current certificate tree and they just need to update in case of a certificate incident (they probably get this info fast and the update should be easy to do via software). Probably they could sustain this service via donations.