"... and the whole system doesn't even work because certificates are issued over plaintext connections, and trusted certificate aurthorities[sic] use very secure keys like "4""
And the CA certificate is "self-signed"
Meanwhile under this "Web PKI" the www user is by default discouraged and/or blocked from using self-signed certificates she herself creates
Someone else decides who she must trust. It's not optional
For example, for a number of years someone else told her she must trust eMudhra
loading story #50439886
loading story #50437249
Unfortunately, smart internet users are outnumbered by not so smart users thousands to one. And the not so smart users aren't smart enough to know every time when a website is or isn't trustworthy. So while far from ideal, the world is a much better place since we gave control of the entire internet to a few aristocrats.
Of course that argument got heavily undermined by the existence of Let's Encrypt.
Certificates don't tell you whether a site is trustworthy.