resulting in them clicking through blindly In the proposed scheme, they are ALWAYS clicking though blindly. There's no way for a user to know when he gets the

resulting in them clicking through blindly In the proposed scheme, they are ALWAYS clicking though blindly. There's no way for a user to know when he gets the original public key or someone else's. How is a user supposed to verify it, call the owners of the website and ask them to dictate their public key? This warning screen is thus just a security theater. The whole proposed "solution" is not a solution at all and doesn't work — the author could have saved a lot of time typing this blog post if they just listed threats that certificates are trying to solve on a piece of paper and put a check mark next to each if their proposed "solution" solves it.