This Cute Chat Site Could Save Your Life And Help Overthrow Your Government (Wired)

The only technology which seems remotely likely to solve this PKI problem is DNSSEC. The HTTPS CA system was too expensive and inflexible and has shot itself in the foot by trying to solve the cost/inflexibility problem by having more CAs. Few end users seem ever likely to want both to learn how to and carry out the maintenance needed to sustain a web of trust based on multiple GPG partial identity trusts.

The main complaints I've heard about DNSSEC are that it isn't widely enough used yet, and we all have to trust ICANN. The first is a chicken & egg problem affecting all new network technology. As the second, nothing to prevent local admins installing a different root zone provider trust anchor if they don't trust ICANN not to mis-sign a TLD that matters to them. In practice technologies such as convergence designed to fix the current CA problem are likely to be more effective if and when used for holding significant DNSSEC signing authorities to account.