@ra6bit : When we visit a shop or bank in the center of town, chances are extremely small that it's a fake. Not so on the internet (and in North Korea).
There is a fix, in short:
1) If people visit a website for the first time, their browser should (before fetching content) show them all known relevant info about the website (and warn for typical phishing domain names, such as "example.com-whatever[.]tld"). And if known, *usable* identifying info of the entity who is responsible for the website. I'm not against anonymous websites, but too often their owners are criminals, so such sites are unsuitable for risky transactions.
2) We need more human readable info in certificates. The CA/B forum must be replaced by a consumer (plus governments) controlled organization.
3) User education.
More details below "WHAT IS A DECENT WEBPKI" in https://infosec.exchange/@ErikvanStraten/113079966331873386.
