I've just read on Ars Technica and TechDirt that starting in January, Microsoft will flag sites with Extended Validation SSL certs with a green "safe bar".
According to draft guidelines (PDF) from the CA/Browser Forum, that green safe bar won't be easy to come by. For one, the cert issuer must verify applicants' addresses against government records. If there isn't a match, an in-person visit is required, along with photographic documentation of the business' building exterior and actual workspace.
VeriSign has started selling EV certs for $2495 (!). GeoTrust's got them too, for $899. As of yet, there's no reference to EV on Comodo's website. GoDaddy seems to be the only web host who plans to offer it, starting in "early 2007".
"Goodbye, SSL padlock", says Nate from Ars Technica. In which case, goodbye also to web hosting providers' revenue stream from SSL cert sales - and good luck to those who've invested in substantial SSL inventories. On one hand, the EV certs aren't priced for the mass market. At the same time, site owners will be reluctant to pay for a second class cert that doesn't come with the coveted green bar.
Dan - there's a Chinese saying about how rule-breakers are 3x faster-moving than rule-makers. Some spyware developer will make a fortune on that safe-bar simulator!
Under the current standard, it appears only corporate entities are eligible for EV SSL certificates, so there's bound to be market segmentation for some time to come, as web hosts will continue to make non-EV certs available for individuals and sole proprietorships.