Then you have leaked material over http or some other cleartext protocol. If you try to add encryption to that you just have turtles or move the key exchange so

Then you have leaked material over http or some other cleartext protocol. If you try to add encryption to that you just have turtles or move the key exchange somewhere else. The current PKI system allows you to make an unsolicited encrypted connections to an internet origin over an untrusted connection with strong server authentication. Self signed can not provide this. We do not want the web to be like SSH.