It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014.
However, a guesstimate of active interception attacks is likely an order of magnitude lower — probably well below 0,5%, and, apparently, a lot of it is done by the governments, which could potentially have control of certificate authorities anyways, so the value of having a trusted CA chain is questionable.
Since most traffic is intercepted merely passively, meaning that encryption without authentication will let you get away from survaillance and preserve your right to privacy in 99,9% of these cases, why the browser vendors and the https industry effectively still promotes no http encryption over the self-signed https certificates for web enthusiasts like myself?
My emails on a dozen of self-hosted domains is encrypted for free (SMTP STARTTLS), without needing to install any new certs every X months, and without people who email me ever getting any warnings.
(Effectively using ssh likewise doesn't require me to remit any payments to anyone.)
Why my non-commercial web-sites and web-properties cannot do the same?