Widespread usage of self-signed certificates might have the unfortunate effect of training people to click "allow invalid certificate" when they shouldn't (such

Widespread usage of self-signed certificates might have the unfortunate effect of training people to click "allow invalid certificate" when they shouldn't (such as what happened with Vista's UAC). I would also argue that unless your users are technically inclined, a self-signed certificate is as good as (or worse, due to the scary browser warnings) as an unencrypted connection.