> It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country

EV certs when they were around showed a big green badge by the URL with the entity's legal name. Presumably this would work similarly, so you'd see ObscureBankInc and not Chase or Citi or whoever.

It'd probably make sense to add a flag indicator, or otherwise warn when the cert is from a country other than the users' own.