You know, you're right. SSH has about the most sane crypto ui out of everything. That's a really sad state of affairs. I also agree with your point about self signed certificates...you it seems like sites should be able to identify you by that. It's probably easier to keep the certificate store on your machine safe than it is to actually follow the best practices that I've seen regarding password selection and usage.