You can get StartSSL to sign a CSR that you generate locally, or at least you could when I generated the cert for my site with them.

This the only nitpick I have with this otherwise fine rant. Everything is broken, rejoice!