In my perfect world, you'd receive a certificate from your ISP when it assigns you one of the IP addresses it was itself assigned, and you'd receive a certifica

In my perfect world, you'd receive a certificate from your ISP when it assigns you one of the IP addresses it was itself assigned, and you'd receive a certificate from your registrar when you purchase a domain name. The former certificate would be good for the duration of your IP assignment; the latter for the duration of your domain ownership. The IP-level certificate would be used for IPsec; the DNS-level certificate would be used for HTTP and other protocols; if you needed some other, stronger sort of identity verification then you'd need to take other measures. This would solve the accessibility problem. As for proxying, I think that HTTP had a really interesting idea with proxying, but it just doesn't work in practice. Proxies are untrustworthy, so it doesn't make sense to use them. As for speed, I don't think SSL is noticeably slow from a modern phone.