I remember when you had to give verisign a few 100 or thousands every year, some random dev would download the thing to their machine and circulate it by email

I remember when you had to give verisign a few 100 or thousands every year, some random dev would download the thing to their machine and circulate it by email for update. None of the competitors were cheaper either. That day wasn't either better or more secure, less so. Ironically, the solution author is pushing forward (basically self signed) is much worse to prevent mitm attacks. I somewhat agree with the precept, it's not great that the web is controlled by Google, beyond just tls certs. Something that changed since this was written is precisely that you have alternatives like zerossl. Saying that letsencrypt doesn't bring any security is plain wrong though. The OWASP top ten doesn't list certificate theft or chain of trust mitm attack, but does have a category for cryptographic failures. My hotel has full control of the wifi, but it hardly has an opportunity to mitm my chain of trust. Same goes for ISP. When you have a cert corresponding to your dns record, it at least shows that you have some control over the infra that is behind that record.