[Sohcahtoa82]

How are the two parties supposed to agree when they've never talked to each other before?

If I connect to https://www.SomeWebsiteIveNeverVisited.com/, how is the web server supposed to tell me where to get the key? Or if I, the client, am choosing where to get the key, how do I securely tell the server where to get it?

Passwords work because they're being sent over TLS which we've decided is "good enough".

[mabynogy]

Those problems exist with current systems. There is a phase where the two parties must recognize themselves and agree they are legit.