Wanted to share a quick blog post (see link) playing around with a couple methods of validating data origin and integrity without blindly relying on public CAs.
It’s sort of a follow-up-to-a-follow-up on an earlier post about using Cloudlfare proxies to selfhost personal sites or services, but it really applies more to TLS and public CAs in general.
Sorry, I think I misread the comment when I made my initial reply.
Edit:
If you mean the key provided for the demonstration, you could ensure that you get the correct one by checking the signature (it’s signed by my personal key) or by doing the initial download through i2p or tor. Once it’s added to your keyring, you maintain that same key for all the subsequent checks. Or, if you don’t want to do either, you could consider it as a Trust-on-first-use system.
The important point is that it’s a layered system, rather than a single point of trust, and that once you trust it, it cannot be compromised.