This is absolutely, entirely wrong. It's so wrong that I need to wonder why you don't even realize you're wrong. A HTTP website with my GPG-signed data is _more_ secure than an HTTPS website. Relying on a CA is not the only way to secure a website. But this isn't about securing websites, this is about forcing us to rely on CAs.