My first concern is, if nowadays is so easy to get your certs signed by a CA how can &quot;Authenticated&#x2F;Encrypted&quot; emails successfully prevent phishing attacks? In my modest opinion there are many week points in X.509 and how CAs are verifying identities, and even if this things were fixed you still have the problem of state-sponsored attacks that have no solution within the current www pki. I personally have no problem if Google wants to add some icon in the UI, but I share OP&#x27;s concerns.