Shouldn't it be possible to detect when this is happening, and who's issuing the certificates? We need a plugin that snarfs the certificates as they hit your browser, and a web service to log them to (send the SHA256 of the cert, and if it's not already there, send the complete contents of the cert).
A nice idea. But isn't the path from you->notaries still vulnerable to man-in-the-middle attacks? You would have to use CA authentication to verify the "notaries" you are talking to aren't fake.
If you can't connect to the servers because the middleman blocked them, a user might assume that the servers were updated, and then proceed to use the spoofed file...
I'm game if someone else is.