It would be nice if Firefox kept track of certs and notified you of changes (like ssh) regardless of them being signed by a CA or not. Especially if servers made their certs continuous (ie, signing the new one with the old one), in which case it would only warn on discontinuous cert changes.