[viraptor]

> but the users were ignorant and continued using the service even after the certificate suddenly changed.

Designing for a perfect user is going to end up in sadness. Users will make mistakes regardless of how experienced they are.

> Intranets are vulnerable only if there is untrusted devices in the network.

In practice that's "always" given large enough networks.