We could not have a central signing authority (ie. use ssh-style approach). This would still mean that Facebook could hand over their key, but would not leave the whole thing wide open as it is now since the NSA likely has already captured the private keys of major certificate authorities.