Yeah, and that happens where?

What’s the use case for OV/EV certs? I thought it was reasonably well established that they herald from the same era as “this site secured by Symantec” icons, and were basically just the same security as DV certs but with the wheels painted chrome and an extra tax for gullible buyers.

It doesn't matter, right? Because anyone who relies on OV/EV certs has chosen to rely on OV/EV certs. If we replaced the whole WebPKI edifice with a blockchain, they'd still make the same decision not to trust the baseline system.

When we talk about the WebPKI being coercively annoying, what we're really talking about are the roots of trust that the browsers have chosen to trust. No browser requires OV/EV.

Yes, a baseline system built on a blockchain could support the validated identity and KYC features of OV/EV certificates. Indeed, this already exists in Sovrin (sovrin.org).

The use case is knowing that a server is owned by who it says it's owned by as validated by a trusted KYC provider. For example, Stripe has an EV cert. Let's Encrypt does not support OV/EV because they cannot automate the KYC checks. Let's Encrypt is focused on the encrypted connection use case.