> So we're spending $3,600,000 every year on certificates that aren't any better than self-signed

Gimme self-signed certificates please. With the ability to verify that the certificate was signed by whoever controls the domain I'm accessing. Abolish all certificate authorities. That's all I ask.