Of course you also need a browser and/or OS to establish the roots of the trust relations.

...and hope symantec/komodo/et al won't start selling those certs by the bucket.

> you now know that the website you want is actually who they say they are?

That's the idea. Of course, validation, while more thorough than for standard certs, still is not that reliable. My strong impression is that it could be fooled by anyone sufficiently motivated.

Not only that - in practice it's kind of meaningless, because if you were served a non-EV cert, you wouldn't notice. And there's usually other domains or subdomains that don't use the EV cert. It's mostly just a kind of token gesture by a business to claim they're more secure.

EV is part of a narrative. Which has some value, even if weak.

Exactly