Self-signed certificates aren't quite as bad as insecure HTTP, since you at least have the ability to manually verify them out-of-band, and even if you don't do

Self-signed certificates aren't quite as bad as insecure HTTP, since you at least have the ability to manually verify them out-of-band, and even if you don't do that, you're still at least safe from passive taps.