Every sale to every individual buyer requires separate handwritten notice, each individually attached to a copy of the privacy policy and the data sold, notarized and sent by certified mail in triplicate, with postage paid by the sender. Make it cost so much that the entire industry becomes obsolete.
Maybe browsers could be configured to automatically accept the first certificate they see for a given .internal domain, and then raise a warning if it ever changes, probably with a special banner to teach the user what an .internal name means the first time they see one