Douglas Crockford has an interesting video on why CA system is broken and how it can be fixed in his recent "upgrading the web" talk at: https://angularu.com/Vi

Douglas Crockford has an interesting video on why CA system is broken and how it can be fixed in his recent "upgrading the web" talk at: https://angularu.com/VideoSession/2015sf/upgrading-the-web https://angularu.com/VideoSession/2015sf/upgrading-the-web Essentially he's proposing side-loading a new application under a custom url scheme so that the browsers will launch a helper app that's used to handle web applications with the following url format: web: publickey @ ipaddress / capability The url contains servers ECC521 public key as part of the url so that it gets around the CA System and clients can just encrypt requests with the servers published public key directly. He's planning on developing the helper app that's based on a sand-boxed node.js and QT application which just uses a TCP session to communicate with the server.