Yes, this is all something you could do with a sideloaded APK. What I'm complaining about is the lax job that the Verge has done in explaining the implications

Yes, this is all something you could do with a sideloaded APK. What I'm complaining about is the lax job that the Verge has done in explaining the implications of installing these certs and/or sideloading an APK. While it's not an insurmountable task, most people who sideload APKs on Android know the risks involved and need some level of proficiency in order to get to the end goal. I'm not opposed to people doing that but I am concerned that they might do that because they've been told they can get "free apps" or "apps that aren't on the App Store" without understanding any of the implications of what's happening when they go down that road. Your phone is yours. Absolutely. No question. In the age of big data, security breaches, and identity theft, though, we shouldn't expect or want to make technology so stupidly easy that people unwittingly give up their privacy and security simply because they didn't know any better. And I know the old adage about "inventing a better idiot" but that's not what I'm concerned about here. I'm concerned about responsible disclosure of the information here. The downside is a few more inconvenient steps for people who would legitimately need to sideload or use a certificate like this while the upside is the ability for a non-savvy user to trust the technology in their hands.