[frabbit]

Or, you can avoid the obvious problem in using a certificate generated by a non-trustable actor and use one which relies on the WoT instead: http://cacert.org

[mike_hearn]

I find WoT based solutions to be much less trustable overall.