The incoherence of EV as a response to phishing is part of why it's failed. But I'm not talking about EV; I could care less about EV. I'm addressing your (false, increasingly so as thread deepens) claim that HTTPS doesn't require any form of PKI and that users might as well rely on self-signed certificates. Obviously: no.