Yeah, I mean it really depends on the brass tacks here. Whatever happens with TLS1.3, obviously the looming idiocy of the CA system is a larger problem. And y

Yeah, I mean it really depends on the brass tacks here. Whatever happens with TLS1.3, obviously the looming idiocy of the CA system is a larger problem. And yes, you're right, trusting random web services (ie, the other endpoint) is often a mistake. But at the end of the day, the users that need to be served by TLS are the endpoints, not the proxy operators. (FWIW, I suspect that TLS as we know it will shift fairly radically anyway as distributed applications become more prominent).