Comment by Avamander

I've long wished for a browser extension that did DNSSEC and DANE validation and displayed which country's CA signed the current cert.

CT helps somewhat, but given that Firefox doesn't enforce it leaves a lot of people vulnerable.