Well, at some point the end-user will have to make a judgement call about the authenticity of the server they're interacting with, but that is no different from what happens now.