"It seems like you're visiting a site registered in XYZ country. Do you want to start trusting XYZ country key authorities?
reply[Do Not Trust], [Trust Once], [Trust Forever]"
Then users just proceeds to hit trust for everything, just like people blindly accept ssh keys.
replyThe country comparison doesn't do much either, because there isn't a good guarantee that they'll correspond. Some guy posted a repo to distrust every CA except the top 30, and that has a bunch of weird examples, like a bunch of russian sites being signed by a Greek CA. Not to mention some of the biggest sites use CAs that don't correspond with their country of origin. GlobalSign is Belgian for instance. Guess how many of their customers aren't Belgian?
Isn't the whole point of this to decide what "shady" CA's to trust? If a Russian site bothered to get signed in Greece, some people will trust the site, and some people will distrust the Greek CA's. That's how trust works.
replyYou can add other options too, "Trust for 30 days" or something. I wish SSH known hosts has an auto-expunge.