Because without a trust anchor (a certificate), encryption is pretty much worthless against MitM attacks.<p>You need a way to verify that the site you&#x27;re connecting to really is who it claims to be before you can trust even an encrypted connection to that site. Otherwise you don&#x27;t know whether you just established an encrypted connection to the website, or an encrypted connection to a malicious attacker.