An old idea of mine: create a new protocol handler (and port?) that has all the security features enabled by default. Can even re-imagine SOP. So instead of visiting https://domain.tld, instead visit web://domain.tld. That won't break any websites and allows gradual adoption.