But to stay on topic: encouraging this kind of major shift to SSL spreads a problem that is still there but is very little acknowledged or worked on -- revocations.

Certificate revocation check is using either CRL or OCSP. CRL is a list of all the revoked certificates - browser needs to download the whole file and then check if the cert is revoked. OCSP is an optimized protocol to perform a more efficient certificate validation.

CRL is slowly being phased out as it grows too fast and there are jokes around that thanks to heartbleed the size becomes comparable to a blockchain.

But now the real issue: almost NONE of the mobile browsers check for revocation! Add to this that by default Chrome is not checking for cert revocation either. So isn't this rendering the whole revocation mechanism almost useless against a real attack?

There is a reason why it's not done in mobile (and Chrome) -- it makes the requests slower, especially in mobile. There is a timeout fallback in browser so that whenever OCSP responder times out then browser assumes the cert is valid. Which is not helping when the real attack is executed.

To sum up, until there is a 99% browser-market covering revocation mechanism that is not slowing down the browser CA-based SSL certificates are too fragile to get us to the safe and encrypted future.