3 ms·

#1 wouldn't work because the attacker could just intercept your request and send you a new fake certificate.