[fexl]

Exactly so. This is the SSH model, and I love it. How does a CA's signature protect against phishing anyway? It doesn't. Equifax signs both the real site and the fake site.