Exactly. Even the famed homakov's company delivers keys via HTTP: http://sakurity.com/contact http://sakurity.com/contact this BS about HTTPS providing the illu

Exactly. Even the famed homakov's company delivers keys via HTTP: http://sakurity.com/contact http://sakurity.com/contact this BS about HTTPS providing the illusion of security is nonsense. It's much harder to even do a protocol downgrade attack (and we have HSTS lists for those!) than it is to replace a single endpoint or key of a HTTP connection.