I know this is on purpose and I use it myself to great extent, but provisioning each legit AP with an asymmetric key pair to be checked by the client proves thi

I know this is on purpose and I use it myself to great extent, but provisioning each legit AP with an asymmetric key pair to be checked by the client proves this is one of the APs you intend to connect to, while still allowing for the roaming functionality. Public areas could even physically display the AP's key fingerprint alongside the SSID (+ WPA key when not open).