Comment by fbcpck

The whole ordeal makes me wonder why the ergonomics/interface around CA trust management is not better.

It should be very easy and normal to ask for approval which is limited to the particular app, limited in time, and limited in scope.

Still keep defaults, but make it much smaller and put them under even higher scrutiny, certainly not 100 root certificates.

I don't understand why e.g. a CA for research institutions should be able to issue certificate for mybank.com or ecommerce.com and my browser would just trust that.