”Though I think that user can install new CA certificate, so it's possible to manuall work around that problem.” Good point. Generally it’s a bad idea for user

”Though I think that user can install new CA certificate, so it's possible to manuall work around that problem.” Good point. Generally it’s a bad idea for users to install any CA certificates on their devices, but in this case I think it makes sense.