Why doesn't something like a P2P consensus protocol or blockchain facilitate certificate authority or even more simply validating SSL fingerprints?
Plus one could argue that a P2P consensus system would be a massive breach of people's privacy. Do you really want everyone upstream knowing what sites you're visiting even if it is just at the domain level?
My point is that while this problem is both true and easy to quantify, a solution would wind up being almost as complex as SSL itself. And it seems like a drop in the bucket when DNS remains insecure, SMTP is still highly common, and HTTP (i.e. not HTTPS) is widespread.
That all being said, if someone developed this as e.g. a Chrome Extension, I'd consider installing it as long as some privacy guarantees were in place.
Also great points about being a drop in the bucket... I asked a similar question tonight "Ask HN: Why don't companies sign email the way we do with HTTPS?" https://news.ycombinator.com/item?id=9098079
It seems even the basic security measures we think are "good" really have no acceptable level of traceability, wide-spread visibility or audibility.
Even still, I'm not totally convinced browsers will spot the MITMs so I don't have to. However, having many-many individual web browsers tracking and sharing SSL fingerprints to potentially provide consensus as well as some history and traceability I believe would be a needed public service.