&gt; I will find or compromise a shady certificate authority and get my own certificate for your domain name<p>Woah there, I don&#x27;t think this is a realistic expectation of an attacker.<p>However, the author is right in that it is much easier to attack the endpoints. Users install every piece of software on the planet, and the Firefox&#x2F;Chrome user storage directory is in clear access for all programs. There are also many remote code execution vulnerabilities in the wild that could be used to query a database server or steal keys.