Extended Validation Certificates Are Dead
I get that it&#x27;s unreasonable to expect users to distinguish EV from DV certs.<p>But a machine should be able to distinguish. There should be an Expect-EV pin header, just like HSTS and Expect-CT. That way you can be sure the certificate wasn&#x27;t issued via DNS hijacking.