Recently learned of http://convergence.io/ (talk: http://youtu.be/UawS3_iuHoA ) which sounds quite promising. It's not perfect (private, non routable sites?) but removes the certificate authority oligopoly from the picture without reducing security (AFAICT).