1) so how do you validate the http the client receives is the http you sent?

Validate it yourself with hashing and PKI. Yes, it needs bootstrapping, just like centralized HTTPS needs bootstrapping.