If you're in a position to MITM a TLS connection, you can most likely also alter those signatures for your target. You would need to use something like DNSSEC

If you're in a position to MITM a TLS connection, you can most likely also alter those signatures for your target. You would need to use something like DNSSEC as well, relying on a government-controlled PKI [1], which isn't really any better than the current situation. [1]: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/