Why is it any worse than the current state of the browser SSL world? When was the last time anyone went through the built-in CA certificate list and deleted all the ones from countries with dubious human rights records, or companies with less-than-stellar security history?