Huh? Which browser alerts me when the cert changes from the previous one that it has seen for a site?
That would be the most basic and trivial mitigation for a start. What we see instead is consortium paralysis for decades. Occam's razor much?
HSTS does nothing for certificate trust. And the other two you mentioned still conveniently keep us at the mercy of browser vendors and infrastructure owners.
Don't drink the snake oil.
This alone would make self-signing much more viable for many uses.
Why?
Why shouldn't sites be forced to announce these changes beforehand?
Why can't we have a "defer all trust to $certificate_authority"-button for the lazy users?
Why is "blind trust" still the default after all these years?
Why can't I even selectively enable a warning when the certificate changes for sites that I really care about (like my bank)?
Seeing the padlock has never told you much interesting to begin with.
You have to click the padlock and compare the fingerprint to a known good one.
Yes, nobody does that. And that's why SSL in the browser is a red herring (as far as 3-letter agencies are concerned).
Why no browser vendor ever tried to fix this basic design flaw is left as an exercise to the reader.