There should be a web of trust for SSL certificates integrated into browsers rather than this bizarre and complex OS/browser-distributed international list of certificate authorities. Than onion sites could have a chain of trust to the end-user without centralized trust systems.
There used to be StartSSL chain-o-trust back-in-days. Centralized, but working. Maybe one day someone creates decentralized one - and browser supporting it. Me breath is holding not :-/
reply