Actually, this post reinforced my belief that we should dump SSL and replace it with something better and safer. It's just not worth the trouble at this point. The flexibility will arrive over the coming years, if there's an alternative with a lot more enthusiasm and resources put into it.
I do not want my customers' security to be based on "enthusiasm," and I can't see any way you could get something with more resources put into it than SSL in a near-future time frame.
