I think ultimately it will have to be social proof that proves which identity a website has. This sounds weird at first but think about it, any type of other identification is going to be text or image based - which is easily spoofed. Certificates can be sort of spoofed too, I mean who looks exactly at that certificate everytime they visit? The certificate itself has a long string in it so the problem really hasn't improved much. For letsencrypt websites the common name actually seems to be some kind of autogenerated string so good luck explaining that to a user (not that he should have to ever check this type of stuff) Google has a social network, they should just integrate URIs aka. "apps" with their social identity. This is also a win&win for them.

Let me explain, if you enter facébook.com then on the url bar it will not show that your friends are on this site as well. The exact gui is irrelevant, the point is that it will be easy to tell whether you are on the right website that you are used to navigating to based on the indicator of amounts of friends and who is using and recommending that site. This will also cultivate a certain awareness that if you are navigating outside your usual url space then you will probably be more careful because it doesn't show that any of your friends are on there yet. Banks might offer a service where their bot "befriends" you on socialnetwork XYZ to get that nice little indicator that you are on the right banking website without anybody else actually having to use it. This system might work for any website actually. If there is a concern that this disincentivizes people from using new websites then I think it will be outweighed by several factors like your desire to establish social proof - meaning that you might be more likely to share the new website you found so you can be safer when visiting it next time because you only have to look at the url indicator and see that friend X that you recommended it to has also added this website to their profile.