Idiocy such as this is a strong argument for the use of PAKE rather than CA-based authentication.  No need to trust anyone other than the site you&#x27;re trying to connect to: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Password-authenticated_key_agreement" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Password-authenticated_key_agr...</a><p>TLDR: Basically, you prove to the website&#x2F;mail server&#x2F;sshd that you know your password, while the site simultaneously proves to you that they also know your password (and hence are actually the site you&#x27;re trying to connect to), all without actually sending the password in either direction.  The password is then used to bootstrap symmetric encryption keys.