Because without a trust anchor (a certificate), encryption is pretty much worthless against MitM attacks. You need a way to verify that the site you're connect

Because without a trust anchor (a certificate), encryption is pretty much worthless against MitM attacks. You need a way to verify that the site you're connecting to really is who it claims to be before you can trust even an encrypted connection to that site. Otherwise you don't know whether you just established an encrypted connection to the website, or an encrypted connection to a malicious attacker.