On: Strengthening HTTP: A Personal View

[jessaustin]

Non-authenticated TLS is trivially vulnerable to MITM attacks.

I don't think a well-implemented TOFU/POP policy would be "trivially vulnerable", but it would still accommodate self-signing. Standardizing this would have been a worthy goal for IETF.

[TazeTSchnitzel → jessaustin]

I'd argue that even if it is MITM-vulnerable, it's still very useful, as it makes passive surveillance impossible.