[joosters]

There's not much to protect against that. But looking for 'perfect' CA protection is hopeless. At least by eliminating the more untrustworthy CAs you can protect against some attacks.