Also, which is the bigger risk for most people: disruption to the cert verification, or malicious runtimes on their system?

(Hint: I have literally never seen an example of one of our bank's customers being unable to bank because of this. I have seen heaps and heaps of examples of endpoint compromises resulting in people having their accounts cleaned out.)