IMHO, OpenPGP did it right. And there is an effort to use OpenPGP to authenticate hosts and users on the web. It already works for SSH: <a href="http://web.monkeysphere.info" rel="nofollow">http://web.monkeysphere.info</a>