[greggman]

That's already true today. Chrome + FF have > 50% of the browser share by most measurements. Both auto-update. So does IE10. Which means the number of people with browsers running from 2008 is already below 50% and falling fast.

[jvdongen]

True - but how is a web server with certainty going to decide which clients can be trusted (because they've a truly capable browser)and which are not to be trusted (because they have a vulnerable and compromised browser that just pretends to be capable and secure)?

Of course it may be possible that one day there is a way around that issue, but currently there is not. Not even academically let alone practically. Hence Thomas's next remarks about the impossibility of 'graceful degradation' for crypto-in-the-browser issues.