SSL is completely and utterly useless <i>without</i> CAs. If there's no way to verify and trust that a given certificate belongs to the website it is being used on, any would-be-man-in-the-middle can just grab a random certificate and use it to completely eliminate all of the security that SSL provides.