TOFU is bad for the web. Its is much easier to MiTM https vs ssh. Many vendors will sell your enterprise kit to do it to all users.

There will be some jurisdictions where MiTM is always and unavoidable. TOFU can't work here.

These things must be universal, and TOFU can never be universal.