[foxylad]

> I can substitute/add/send...

Only if you control any of the infrastructure. If you do, then you can make my life a misery anyway, encrypted or not.

[sarciszewski]

Authenticated and encrypted? That throws a wrench into things.

[jessaustin]

The authentication provided by the extant PKI system is much weaker than the encryption provided. Any CA can do anything it wants, and browsers trust lots of them.