[Spivak]

But since every device needs to trust your CA aren't you forced to pack their belongings in either case?

[yfiapo]

Hmm, I'm straining my own analogy already so I won't try to beat that horse any deader. :-) I am mostly trying to argue the positives of centralized inspection at network chokepoints in simplicity and guarantee of coverage.