> No-one has to be, and it certainly doesn't need to be anyone but the owner of the machine.

Technically the web should work with self-signed certificates. But that is likewise impractical.