Maybe baby steps are a good option, but I'd like to eventually see all traffic signed with keys stored in a distributed ledger like namecoin. Good on the IETF for moving forward though.
Even if certificate authorities are compromised by major governments, SSL is still enough for now to keep my credit card safe from the shady guy in the back corner of the coffee shop. Or to keep my Google searches private from the techies at my ISP.
There are some upcoming workaround that will help too like cert pinning or DANE.
In any case, if PKI trust model is broken, then nothing can be trusted. Decentralized network relies on a degree of trust in the software developers and the hardware engineers.