More importantly, I fail to see what the problem is, really. If the user is clueless enough and doesn't understand how to validate a certificate, what good it does if we choose a certificate that is included in a (popular) particular program?
I know nothing about this; I might not know how to do it. I hope you are not saying that people like me are unimportant when we judge what Savannah should do.