> If the owner has root, then he can make the device trust his own certificate

Or manufacturers could allow users to set their own trusted certificate. Doesn't need root, can be reasonably secure.