I agree with you, but I think you have far too much faith in ordinary Americans. I invented some widely used anti-phishing technology, and I can tell you that spending a few months analyzing actual incidents where otherwise intelligent people did ridiculously unsafe things on the Internet will give you a new perspective on the tech savvy of the general population. Unless we (the tech community) make strong security both transparent to the user and enabled by default, the feds will be seeing everything they do. Sadly, most of them seem OK with that.
Moreover, even if only the 10% best informed people use PRISM-proof communications, it's a safe bet that NSA's alleged targets (whatever the current definition of "terrorist" might be) are among them, so the argument that they're doing that to catch "terrorists" doesn't hold water anymore.
I believe the tech community is concerned about this, because it threatens the robustness of Internet. Today, nobody in the business can pretend with a straight face that top-level certification authorities are trustworthy; so I expect the next generation of security protocols, the successors of the (transparent and enabled by default) SSL, to treat governments as opponents.
I also believe that companies will change their security patterns, e.g. stop trusting American third parties such as Microsoft if they have competitors with political connections in Washington.
Yes, please do alert users that self-signed certificates are potentially sourced by nefarious organizations. But in most cases, they are used by small companies and individuals to simply encrypted content from trusted servers. So allow them to be permanently trusted.
Perhaps we will see an increase in interest in web-of-trust alternatives?
I do think that the average joe, doesn't know what a certificate or CA is, should be protected from automatically trusting an unknown CA.
The point is, if what you do interest the US government, it can compel Verisign and the likes to betray your trust, so you shouldn't trust them. And what emerges progressively is that the threshold beyond which you're deemed "interesting" by US administrations is way lower than long believed.
If you're a company doing international business, you want to secure your strategic communications with your own root CA, not with that of a company who can't say no to the government.
It is if you're targeted. But then, if the US government is after you, you're already screwed anyway.
The point is to impede generalized surveillance of everyone without probable cause. Even if MS-Windows and OSX are bugged, which is almost certain, the NSA can't siphon all your data through your routers inconspicuously. It can only grab selected data from the computers of high-value targets, at a considerable cost, which is fine.
It's not about preventing states from surveilling legitimate suspects, it's about forcing them to respect the privacy of average joes, and limiting their control on the Internet as a whole.
fixed that for you
My completely anecdotal experience is that when people want privacy, they're starting to avoid all manner of electronic communication.
The whole PRISM scheme worked because people supposed the government respected their privacy. Now that it's been proven false, I expect people to use local encryption schemes, were third parties can't give a key they don't have. I expect people to become careful about which certification authority signed their SSL key, and to use self-signed certificates whenever practical. Targeted spying will remain possible, but indiscriminate surveillance PRISM-style would become impractical.
Unless they know how to crack TLS, but we have no reason to believe this as of today.