Hacker News Reader

Yeah, and even if you get a certificate from a CA which isn't, it doesn't matter, since any other CA can still issue a cert for your domain.

Cert pinning and http://tools.ietf.org/html/rfc6962 would help for those cases.

Yay for a trust automaton, another level of complexity that won't solve anything.