this piece bugs me...
In practice, we expect many domains to use a third-party service
provider for Sovereign Key management,3 but the domain holders can
choose exactly which if any such parties they wish to trust.
So there will be a handful of Sovereign Key Management (SKM) companies similar to the handful of Certificate root companies now. They will charge an exorbidant fee to store your Key for you, and half the websites won't do it. THEN the browsers will (instead of blocking the invalid key) have to default to a "The Sovereign Key for the website you are attempting to access is invalid. Would you like to continue to the website anyway?"
How is this different from what we have now?