The point is you don't know what the public key of the target website is. You find out by asking for it, and then you verify it's authenticity by checking the s

The point is you don't know what the public key of the target website is. You find out by asking for it, and then you verify it's authenticity by checking the signature. Before you connect all you know is the domain and the keys of CA's you trust.