[quonn]

> normal folks cannot distinguish a self signed certificate from a malicious used one

What do you mean with "normal folks"? Nobody can possibly distinguish this, since an attacker would also just use a self-signed certificate.