Sites need to be able to update their certs without giving a scary warning to all their repeat visitors.
Why?
Why shouldn't sites be forced to announce these changes beforehand?
Why can't we have a "defer all trust to $certificate_authority"-button for the lazy users?
Why is "blind trust" still the default after all these years?
Why can't I even selectively enable a warning when the certificate changes for sites that I really care about (like my bank)?