You could also self sign - It's going to be grating for users, but your still afforded the protections against any hop on the path.