Well, that's quite obvious that PKI in the "big internet" as we know it is just a card house: if *ANY* CA we trust get compromised or mailicious, it is all flawed. There is nothing we can do besides examining chain of trust manually and watching for certificate changes. The TOFU technology described there is quite obvious, i always wondered why ssh has it and browsers do not. It is completely out of the scope of the certid list, though :-(
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.