[simias]

Wouldn't it be possible to MitM the SSL traffic by using a self signed certificate? Does Steam use its own CA list or does it use the one from Windows?