> normal folks cannot distinguish a self signed certificate from a malicious used one What do you mean with "normal folks"? Nobody can possibly distinguish thi

> normal folks cannot distinguish a self signed certificate from a malicious used one What do you mean with "normal folks"? Nobody can possibly distinguish this, since an attacker would also just use a self-signed certificate.