> escape hatch to be "download the source and change it yourself"

In theory I agree. In practice building a modern browser is neither easy nor is it feasible to do so on an average computer.

Given that a nag message would suffice to coerce all mainstream operators (thus accomplishing the goals I've seen stated) I'm left unconvinced. That said, I'm not particularly bothered since the trivial workaround is a self signed certificate and the user adding an exception. It's admittedly a case of principle rather than practice.