I think the real take-away here is that there is just no substitute for looking at the URL bar to see the domain. HTTPS means that the url bar is not lying, but you still have to look there and see if it's the correct entity.
EV certs are more of the same - you still have to look up at that URL bar and see the organization name.
All of us who know how to trust websites, do it by looking at the domain. We don't remember what sites have an EV cert. It doesn't matter, the standard procedure always works: check https, check domain, done.
No other solution works reliably, at the scale of the web. Any other solution ends up adding complication. Doing this the right way really isn't hard, people just need one half-hour class, in their entire life, to enable them to reasonably safely use the web.
EV certs are more of the same - you still have to look up at that URL bar and see the organization name.
All of us who know how to trust websites, do it by looking at the domain. We don't remember what sites have an EV cert. It doesn't matter, the standard procedure always works: check https, check domain, done.
No other solution works reliably, at the scale of the web. Any other solution ends up adding complication. Doing this the right way really isn't hard, people just need one half-hour class, in their entire life, to enable them to reasonably safely use the web.