Which underscores the need to use additional authentication measures like DANE [1] and key pinning. Making it harder for malicious entities to wriggle their way into connections seems vital here.

[1] http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...