> perhaps you need more so that one being stupid doesn't effect so much.

So you create more surface area for vulnerability? We might already be at or close to the sweet spot. Security is hard.

I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)