It does protect against MITM. A man in the middle can pass the content along or they can refuse to do so but they can't forge a signature.

If confidentiality is required, well you already have a public key that you're using to verify content, then the content can say: "reach us at 196.7.3.45" and then you encrypt communications to that address with the same public key you use for validating content.

Or maybe they'll specify, in the content, that you should use a different key for that, but either way the chain of trust is preserved.

This would of course all be protocol level stuff, handled by the browser, not a human. They just have to maintain a list of keys they trust.

>It does protect against MITM. A man in the middle can pass the content along or they can refuse to do so but they can't forge a signature.

Um, I don't think you understand this problem near as good as you think you do?

>A man in the middle can pass the content along or they can refuse to do so but they can't forge a signature.

So where do you get this signature exactly so they don't MITM you the first time?

> well you already have a public key that you're using to verify content,

Who what where when why? Where did I get this public key? Who provided it? Is this my public key or their public key? How do I trust it?

>They just have to maintain a list of keys they trust.

So you've solved exactly nothing.