If my bank appears to switch to a CA with a record of issuing fraudulent certificates or enabling same (cf. Comodo, Symantec), that's exactly what I want to happen!

I realize the desire to control my own security is thought by browser-makers to be the death of ecommerce.

I still want it.

Ok, what happens if it switches to a CA you haven’t heard of?

What happens when some 20 year old gets their first computer, it doesn’t have any CAs in the trust store so how do they find the good ones? How do they know what the good ones are?

You think you want it, but you don’t necessarily know which CAs are good - have you read all the audits (which you can only trust if you got over tls, which requires you trust it).

What happens when you get a site saying “you need to trust ‘Google CA 1’/‘LetsEncrypt’” (or whatever their public CA is). I’m joking of course - the name is meaningless - there’s no root of trust to verify that it’s not someone making a certificate that just claims to be that CA. So you actually need to know the public key for each CA that you think is trustworthy.

If it was all CAs by default, but then allowed you to remove the ones you didn't trust, then that would help a lot. Then the vast majority of users will be going with the browser recommended CAs, but advanced users can customize. If there was a distribution format for experts to "vote/warn" on which CAs are trusted, then you could subscribe to their lists with a common configuration of (Trusted by All, Trusted by At Least One, Not Warned By Any, Not Warned by All). That way you could get updates automatically from your favorite experts. We often outsource things like reviewing all the advisories in this way. Now we just need someone to develop this in. Could it be done as an extension?

I don’t know about windows or Linux, but you can already do this on Mac. Keychain access let’s you change trust settings of each root, including individual “purpose” granularity (eg restrict to just mail servers, etc)

you know deep down that's not the rigth solution. if you have to accept any CA for each site, then next day you will be complaining why you have to click "yes" on that damn dialog for every new site. and then ask browsers to just accept it and not bother you :)