"You just generate a cert locally and then copy the public key to the site when you register." But how do you know you're copying your key to the right site an

"You just generate a cert locally and then copy the public key to the site when you register." But how do you know you're copying your key to the right site and not some fake? Answer is, of course, you don't, so you need something else. And it's not stronger than the weakest link..