You’re correct about the coffee shop wifi being less of a problem year on year. Though WPA3 only gets you as far as the access point you’re connecting to - you

You’re correct about the coffee shop wifi being less of a problem year on year. Though WPA3 only gets you as far as the access point you’re connecting to - you still have the rest of the networks your traffic will grace between that access point and your destination. With TLS encrypting web traffic we’re trying to secure the traffic as it makes that journey, in combination with WPA3 we’re making use of defence in depth - rendering your coffee shop attacker useless. It’s not just bad actors at the coffee shop or at the government level intercepting traffic though: Less scrupulous ISP’s will intercept plaintext traffic, doing dynamic ad insertion, dynamic image compression, or (theoretically) scraping content to build profiles on their customers - personally I object to those behaviours. Is it not good practice that firms doing SSL Termination at a third party should be forwarding traffic onto their own equipment using their own or different certificates? I don’t think anyone should trust any computer on the networks between their browser and the site they’re browsing, the internet is a much less trustworthy place than it was in the 90’s.