I have a question about this -- maybe I'm ignorant. But using https without self-signed keys actually allows the government to peer into your communications, doesn't it? We are worried about third parties stealing your data between you and your bank for example. A bank might be a bad example as they probably already have access to their databases for compliance reasons. Can't the US government ask for the keys of these US based certificate authorities?
My point being is that https is probably equivalent to plain text when it comes to government surveillance.
My point being is that https is probably equivalent to plain text when it comes to government surveillance.