> EV certs would still satisfy nonrepudiation, in a way. You'd have to be pretty bold to run a phishing site under a company registered in your targets' country under your legal name.

I don't think that would be the failure mode. It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country, taking advantage of the asymmetry in cybersecurity budget between those two entities. Users would have to actually check the EV cert DN every time (unlikely so successful for a phisher then) or rely on things orthogonal to EV certs like pinning.

> It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country

EV certs when they were around showed a big green badge by the URL with the entity's legal name. Presumably this would work similarly, so you'd see ObscureBankInc and not Chase or Citi or whoever.

It'd probably make sense to add a flag indicator, or otherwise warn when the cert is from a country other than the users' own.

If we showed the EV cert DN in the the address bar next to the domain instead of hiding it in a place that takes two mouse clicks to reach we could expect at least a portion of victims to notice. I vaguely recall some browsers might have even been doing that once upon a time?

Additionally, the browser could show a warning if a ccTLD is served with an EV cert of an entity outside that country. Doesn't help the US because of the obscurity of .us, but useful for the rest of the world