Chains of trust can't defend you from this. Only certificate pinning. IMO this shows why self signed is the way to go: There are no authorities you can trust.
We agree about pinning.
As pinning becomes more widespread, browsers that support it will become a sort of surveillance network for forged certificates. That's effectively what caused the Turktrust discovery.
You're correct that this won't protect against a MITM during this first visit and will cause confusion if an attacker pins his fraudulent public key. However, I would argue that pinning provides a large net security gain in practice. The same model of vulnerable initial visit but secure subsequent visits is used in HSTS to prevent ssl stripping attacks.