Couldn't Mallory just replace the certificate with her own one? The browser would just pop up the same warning. The warning should show some form of a public ke

Couldn't Mallory just replace the certificate with her own one? The browser would just pop up the same warning. The warning should show some form of a public key fingerprint at least before clicking through "I understand the risk".