[ikeboy]

But you don't know that this is the client. If all you're trusting is the cert they already generated, how do you know it's not an attacker?

[gandarojin]

You’re right, I did not think this through…