Nitpick: Verisign isn't in the CA business anymore, Symantec bought it.

Let the system be unfair to the smaller CAs, and better for end-users.

But how is the system better for end-users? If a big CA fucks up, they're either at the risk of being MITMed or of having half their secure sites stop working. If no CA had more than, say, 10% of the market, a fuck up would only affect a small number of the sites they use.

My logic is simple: fewer CAs selling the whole Internet trust scheme to the highest bidder = safer Internet.

If SYMC's CA is going to be above the law, so be it. We don't have to solve every problem simultaneously.