[tptacek]

If certificates are BS, give me hosts.txt entry I can point INSTAGRAM.COM that my browser will actually honor. It should be easy.

Certificates are problematic. But that's because the world is problematic. They were much more problematic 10-15 years ago. Google and Mozilla drastically mitigated their problems. They're still imperfect, but anything that expresses web trust across the entire world is always goign to be imperfect, and the webPKI at least has some stakeholders that are both empowered and deeply give a shit about security.