>It does protect against MITM. A man in the middle can pass the content along or they can refuse to do so but they can't forge a signature.

Um, I don't think you understand this problem near as good as you think you do?

>A man in the middle can pass the content along or they can refuse to do so but they can't forge a signature.

So where do you get this signature exactly so they don't MITM you the first time?

> well you already have a public key that you're using to verify content,

Who what where when why? Where did I get this public key? Who provided it? Is this my public key or their public key? How do I trust it?

>They just have to maintain a list of keys they trust.

So you've solved exactly nothing.

> So where do you get this signature exactly so they don't MITM you the first time?

That's always going to depend on why you're trusting them in the first place. If somebody handed you a business card the key should be on the card. If it was a recommendation from a friend you should use whatever key they use.

If you're expecting to just type random IP addresses into your browser until you hit something and then be told that you should trust what you see... Well that's not in the cards because you shouldn't trust what you see in that scenario.

We already don't type in URL's, we send links to each other. It really wouldn't be so difficult to change the UX so that when we delegate trust in that way it's public keys that are being trafficked instead.

> So you've solved exactly nothing.

Removing untrustworthy third parties and the need to revoke trust in them on the user's behalf is the solution. Users don't know what a CA is or how they should evaluate its trustworthiness. We need a system where they're instead evaluating the trustworthiness of things they understand, like other people.

When they get burned they should have the ability to immediately revoke trust in whoever burned them. This thing we're doing where we expect them to wait around while some nerd pushes the updated list to them and to blindly trust that that nerd isn't curating that list with ulterior motives is totally bonkers.