SSH authentication is TOFU, trust on first use. The user will be asked to confirm if the endpoint is legit.
But the average user has no idea if the website saying it's paypal really is paypal. Could be payscam instead, operated by Mr. Untrustworthy, AZ.
SSH works because the servers and endpoints you connect to are usually endpoints the user has setup themselves and are in the local area network.
>Unfortunately for users, this is delegating the intervention to humans that have no "skin in the game".
CA's do have skin in the game. If they fuck it up too often nobody will trust them anymore to verify trust. See: StartSSL, Symantec and soon Trustico.
If the encryption is defeated then the CA's entire business model collapses. The CA's have strong incentives to not fuck it up or not get caught doing so.
With Certificate Transparency we have tools to catch anyone trying to not get caught cheating.
>Common sense suggests this is the wrong approach. (And that's ignoring the ever-increasing number of exposed flaws and "incidents" regarding www commercial CAs, like the one being discussed in this thread.)
To verify the key of a endpoint you either have to decide yourself if it is trustworthy or rely on a third party.
If you don't verify with a third party and you don't ask the user if the connection is okay, MitM is trivial.
If you ask the user, social engineering can make MitM trivial.
A third party will be required in some way, be it a CA or the Web of Trust or something else. However, the CA model has been the only one that successfully operated at this scale. The WoT has largely degraded to TOFU for 90% of users.