If we're to meet in person, how do you know it's me? How do you know someone didn't kidnap me then go in my place? You'd go seek third party validation either v

If we're to meet in person, how do you know it's me? How do you know someone didn't kidnap me then go in my place? You'd go seek third party validation either via looking up my picture somewhere or checking my passport. I'm not sure what your point is. Self-signed certs simply do not work unless you find another way to validate. They cannot be used as-is to provide "encryption without authentication"; such a thing simply does not exist. CA name restrictions are already a thing, but doesn't really solve the problem. Moving to DNS like DNSSEC just changes from the CA to the registrars and hence world governments. And it's a lot harder to block a registrar than a CA... > the amount of damage that could be done in a busy place with free wifi and a bad gmail.com certificate This has happened. Chrome detects it, fails the connection, reports the problem, and the CA gets killed. It's pretty much what happened to CNNIC via an idiotic intermediary by accident.