Yes. Most Linux distributions I've used recently come with a pre-configured self-signed certificate called 'snakeoil'. I'm not sure if the 5-10 number is real

Yes. Most Linux distributions I've used recently come with a pre-configured self-signed certificate called 'snakeoil'. I'm not sure if the 5-10 number is really okay for a _decent_ validation process, but I'd argue that it's really, really a sign of a crappy industry if only StartSSL offers a free/cheap way to get a simple, low-trust certificate for your site. If we leave the scope of ssl and enter code-signing I'm even less happy with the trend.. There was a nice write-up on the Windows 8 'market' a while ago which complained about that stuff, among other things.