> it's just deliberately not easy

And thus crippled and useless against state attackers.

I fail to see the reason why my browser refuses to let me "pin" a CA only for certain sites for example.