Actually most Web sites do implement forward secrecy, i.e. at least one of the "DHE" (or "ECDHE") cipher suites. Most SSL implementations support them out of the box, and most SSL server certificates are adequate (with a DHE cipher suite, the server's key is used for a signature; but almost everybody uses RSA and almost all RSA certificates allow the key usage for signatures).
However, most SSL implementations are also courteous, in that the server follows the client preferences. This means that, in the list of cipher suites announced as supported by the client (in the
ClientHello message), the server will usually select the first one which is also supported on the server side. Since most clients tend to put the non-DHE cipher suites first, DHE suites remain unused.
The extra cost incurred by DHE cipher suites is slight, and almost always negligible:
The computational cost for the handshake is about doubled. This means that a basic server may do "only" 1000 full handshakes per second instead of 3000, based on its available CPU. Since servers don't usually boast 1000 new clients per second, on a single PC, this limitation is never a true limitation in practice.
The extra bandwidth is small: less than 1 kilobyte of overhead induced by the use of a DHE cipher suite. There again, this overhead is only for a full handshake, i.e. the very first connection between a client and a server; subsequent connections will use the "abbreviated handshake", which is more efficient, and completely unimpacted by the actual cipher suite.
So, to sum up, forward secrecy is already there and it is underused only because of the traditional behaviour of clients and servers (preference order) which remains as it is for no good technical reason, only inertia. In some cases, developers or sysadmins deactivate DHE support based on some unsubstantiated rumour about how DHE is "very expensive" and "might heavily impact performance", but these myths are easily dispelled with some actual benchmarks, and are still rare. Browsers and servers choose non-DHE cipher suites mostly because that is the default behaviour and nobody feels motivated enough to do anything about it.
To be complete, there is an extra effect: when the BEAST attack was published, people semi-panicked, and the common mantra was: "use RC4, it is immune". SSL has no DHE cipher suite with RC4 (there is no incompatibility between DH and RC4, but it just happens that no such standard cipher suite has been defined). So this resulted in clients and servers preferring RC4 cipher suites, which indirectly implies not using the DHE cipher suites.