What we really want is some way to be able to check the fingerprints to make sure that the cert that's being used is the expected one. This unfortunately doesn't seem possible without some out-of-band communications system.

Here in Thailand the junta promises to MITM all TLS traffic. I doubt it can be stopped, but it would be good to at least be able to see when they do it. I don't see sites publish their certificate fingerprints anywhere which would at least allow some form of manual check.

It might be enough to be able to get the browser to tell us when a certificate changes -- this would need to be opt in of course.