The security model is broken, just like BGP's is. Root CAs plainly can't be trusted. It's not just that they'll cooperate with governments. See "Security Collapse in the HTTPS Market".[0]

[0] http://queue.acm.org/detail.cfm?id=2673311