You want to use something like TLSpool (http://www.tlspool.org) and DANE. For a browser something like Firefox's Certificate Patrol is a great solution.