>out-of-band identification would also be possible, i.e. a QR code Any out-of-band method of enabling what you are talking about is necessarily going to prompt

>out-of-band identification would also be possible, i.e. a QR code Any out-of-band method of enabling what you are talking about is necessarily going to prompt the user with the same kind of serious-looking security prompt they would see when adding a self-signed cert to the OS certificate store.