That's a specific facet of the CA layout we've adopted for HTTPS; PKI as a whole does not require it. You need to trust something, but that something is often y

That's a specific facet of the CA layout we've adopted for HTTPS; PKI as a whole does not require it. You need to trust something, but that something is often your own organization's CA (many VPNs) or the keys of people you've met (GPG) or the servers you've deployed (SSH, though SSH now supports use of CA keys).