Just an idea... should we consider the problem is not with the first visit, but with subsequent visits? If I sign-up on a website (bank, Google, etc), all I wa

Just an idea... should we consider the problem is not with the first visit, but with subsequent visits? If I sign-up on a website (bank, Google, etc), all I want to ensure after that is that when I go back to that site, I will sign-in to the right website and not a phishing one. CAs don't provide this guarantee, when a simple self signed certificate would! Certs signed by CAs provide some kind of identity, while a self signed ad-hoc cert would provide strong identity! Let's imagine 3 factor auth: something I know, something I have, something they GAVE me. In the case of Google, I would gladly install a Google CA cert for all of Google's services. Okay, I just checked and Google is already its own issuing CA :) When SSL was born, the "problem" was to send your credit card number to an authenticated website (web store). Nowadays, we're loyal returning customers, and we want to sign-in without any ambiguity. Maybe we should kill generic CAs? and favor self signed certs after all. I could trust any self-signed cert, if the only guarantee I need is that I'll always return to the same website where I opened my account. Remember, that was just an idea, please tell me where I'm totally wrong!