@jomo You cannot solve the issue of PKI. The system itself, considering certificate transparency and stuff is already quite well for TLS. #Trustico's issue could be prevented by stopping (preventing) users from generating keys in websites. That has not much to do with PKI.

Currently there do not exists alternatives, which scale as well as the current PKI.