You can encrypt between end points using self signed certs or your own CA just fine, but without the CA system you'll need some other way to prove that the signer is who you think they are. This could be a phone call or whatever other method you like