&gt; However, having one and not the other isn&#x27;t totally useless.<p>&gt; Having the browser be able to track and tell me that &quot;Though we aren&#x27;t sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website&quot; is something I&#x27;d consider to be useful. (Actually, telling me if it changes would be the useful bit).<p>Isn&#x27;t that what you do when you make a security exception for a self-signed certificate? Having that enabled by default lulls people into a false sense of security.