It doesn’t require new infrastructure most modern browsers support HTTP Public Key Pinning. Since the browser vendor can pin their own keys in the distribution

It doesn’t require new infrastructure most modern browsers support HTTP Public Key Pinning. Since the browser vendor can pin their own keys in the distribution it gives you a sufficiently resilient proof against impersonation as all other keys can be validated through a connection that is known to be non susceptible to impersonation.