Well, its hardly possible to manually browse an unapproved unsafe URL even today. Ever tried to browse a site with a self-signed certificate? In most browsers you have to do a lot of extra clicks to get in.

But there will always be special purpose browsers. There is "TOR browser" today, and we will have "vintage web browsers" the same way we have CLI/TLI browsers still today (thinking of elinks and lynx), or the same way as there are still FTP clients and Gopher clients.

iPhone doesn't allow true 3rd party browsers only reskinned Safari. Apple even removed a browser for extending safari too much [0]. So while there will be vintage web browsers, normal people may not have access to them.

https://www.theverge.com/2020/10/20/21524665/stadium-stadia-...

All the certificate verifies is that the server you are connected to actually belongs to someone who controls the domain that it's hosted at.

You can get one issued for free just by demonstrating that you actually control the domain.

There is so much on TLS beyond Let's Encrypt. For instance, TLS allows user certificates to authenticate the user, not the server. This works a bit like SSH passwordless login (thanks to key authentication). This technique only works if the site operator also controls a CA which the browser accepts. Companies can easily install self-signed certs to do so, but on the wild web that's quite difficult.

So yeah, even today there are use cases for custom CAs.

I'm aware that client certificates exist. I'm not aware of anyone actually using them.

It also doesn't really have the problem of "unapproved" sites. You are already installing a certificate on the client. It's no extra work to add another trusted CA at the same time.

This is the real nightmare scenario...