agree completely and it's worth noting that i don't have a solution to the issues i mentioned, either.

leveraging other (potentially-insecure) paths to establish trust might help further enhance confidence in authenticity; e.g. verification using something like the broad-based strategy of moxie's perspectives (except via plaintext) or maybe through additional verification of plaintext on the site as fetched via tor or retrieving a cached copy of the site securely from the internet archive or search engines.

dvsni and multipath testing sound quite interesting, and i think defense in depth is the right approach.

having been at akamai's recent edge conference, i didn't hear much from them on this. does anyone have any additional details of their interest in the project?