OCSP was supposed to block fraudulent certificates (as long as the break-in is noticed and published); because of softfails the protocol fails at this task.

Google's security researchers are proposing an incrementally deployed, admin-friendly way to prevent fraudulent certificates: Certificate transparency. Part of it is a public log of what certificates were issued, so that site ops notice when a certificate is issued which they didn't ask for.

Details: http://www.links.org/?p=1212