Researchers break certificate authorities' domain validation (theregister.co.uk)

I know this will never happen, but I would prefer to import physical objects from my bank rather than trust a CA. Even a QR code printout out really large on their wall behind ballistic glass would be a step in the right direction.