I wonder why you're excluding StartSSL. It's no matter if you trust them as long as all major OS/browsers trust them.