In reply to markk5.

You are confusing PKI with SSL. Encryption is the point of SSL/TLS. Verification is where PKI comes in.

Even if nation states can bypass SSL using rogue certs it doesn't mean that the rest of society can. SSL is essential for protection against criminals, rogue ISPs and nosy neighbours as well.

I should like to point out that in future we won't be relying on CAs to sign our SSL certs. DANE and DNSSEC will allow us to sign our own certs that browsers can trust.

You are wrong about 1 as well. At best the ISP knows what domain you are connecting to. Which pages and what content you are viewing is not known to the ISP because URLs, GET and POST requests are all encrypted.