Your OS or an app talking to their mothership can and do use cert pinning. What about all the millions of websites? A rogue/compromised CA will be caught by ce

Your OS or an app talking to their mothership can and do use cert pinning. What about all the millions of websites? A rogue/compromised CA will be caught by certificate transparency and distrusted. Also, as 'tptacek noted, you haven't explained how to securely use self signed certs to protect against attacker at the WiFi AP, which is a very accessible kind of attack (compared to compromising a CA, a registrar, a datacenter or internet backbone traffic).