* Key continuity (a la SSH)
* Web of trust (a la PGP Keyservers)
* PKI (a la SSL CAs)
Of these three, only key continuity appears to work in practice.
I'm eagerly awaiting the UX invention that somehow merges continuity and web-of-trust to make the latter tractable.
I'm definitely not complaining that there's no web-of-trust, since I don't believe in it as a workable UX solution for normal people.
I believe the mainstream Web services hold the key (no pun intended) to UX for web-of-trust key exchange. Their users have access to real time communication which would make subverting key exchange and key signing hard, and building a Web of trust convenient, including key replacement, etc. The secure specialty services don't have that capability, and so they remain privacy-for-wonks.
I'm certainly willing to consider that I could be wrong about that. But with trust in short supply, someone should be tempted to build products that say "Trust no central authority, trust this math and the open code that implements it."
But you could also say that ephemeral keys are user controlled to the extent they are exchanged end-to-end and the conversation can't be evesdropped.
Your objection amounts to saying "We don't have easy, trustworthy key exchange backed by a web of trust."