If one wants an opportunistic encryption, there're tcpcrypt or IPsec for that. If one wants to encourage others to blindly accept untrusted certificates from w

If one wants an opportunistic encryption, there're tcpcrypt or IPsec for that. If one wants to encourage others to blindly accept untrusted certificates from whatever server decides "to hell with authorities" - that's not a good idea. When those World Power Adversaries will consider messing with the site, visitors will already be trained to accept the certificate (hah!) If one really insists on self-signed certificate, there should be at least an HTTP (i.e. accessible without accepting anything!) page describing the reasoning behind the whole situation and providing means to validate the certificate. Like, say, a PGP signature of certificate in question, signed with a key that could be traced to site owner with reasonable level of trust. Or at least TLSA DNS records (dig says there're none).