The problem with allowing self-signed certificates has always been distinguishing if a site should be signed by a CA or not. Consider the follow situation: Ali

The problem with allowing self-signed certificates has always been distinguishing if a site should be signed by a CA or not. Consider the follow situation: Alice sends Bob a link: http://example.com http://example.com Bob trusts Alice and now knows that example.com is probably ment to be accessed over HTTP. Now for the next example: Alice sends Bob a link: https://example.com https://example.com With the current implementation of browsers Bob knows that example.com should present a CA signed certificate. But what if example.com wants to encrypt their data, but for whatever reason uses a self-signed certificate? Some people say that Bob's browser should not display a "big scary" warning, but instead display a UI similar to when accessing a HTTP site. However, in this situation HTTPS has lost some meaning. I think http2 should work as follows: http2:// - encrypted, not verified https2:// - encrypted and verified This way the protocol still conveys the same level of information. However, if it were completely up to me, I would say ditch the CAs and use namecoin to verify certificates.