You want to use something like TLSpool (http://www.tlspool.org http://www.tlspool.org) and DANE. For a browser something like Firefox's Certificate Patrol is a

You want to use something like TLSpool (http://www.tlspool.org http://www.tlspool.org) and DANE. For a browser something like Firefox's Certificate Patrol is a great solution.