[thatcks]

My apologies for not being clear about my DigiNotar and StartComm examples. What I intended to point out here is that in neither case were these failures something which one could have discovered in advance by reasonable amounts of checking how trustworthy the CA was. DigiNotar's compromise was (as far as I know) completely unpredictable and appears to have come from a state-level attack; StartComm actively hid itself and took significant work to uncover. Both CAs would have passed most people's checks done beforehand.

If advance warning is nonexistent, there's no point in even trying to check. If advance warning is hidden, you have a cost/benefit tradeoff to make, and I believe that in most cases (ie with low amounts of money involved), it's not good use of scarce and expensive engineer time to try to assess the state of a CA.

(This is especially the case if your company doesn't already have an engineer who is relatively expert in the CA ecosystem and knows where to even start looking. Without that expertise, would something like StartComm's quiet sale to WoSign have raised any alarms even if you discovered it?)

As far as magic bits go, the one thing that self-generated magic bits can't do is insure that a complete first time visitor can't be MITM'd by an active attacker. Whether this matters (or matters more than the scary browser warnings) depends on circumstances.