> but the problem is that there exist many users who don't know how to review JavaScript and don't know what a CA is, and will just rely on what their browser tells them (which is where a plugin comes in handy.)

> a plugin can be verified locally at length whereas a compromised CA can issue a fake cert that is very, very difficult to detect.

Which is it?

Either you're claiming that verifying a plugin is easier than not trusting CAs that you don't trust, or you're arguing two completely contrary positions.

edit:

And this then brings us back to the earlier point, which is why not just use the plugin for crypto in the first place?