2 ms·

Good points. Additionally: if you control the client, you can also trust your own CA only, or even just require a specific certificate.