Comment by akerl_

We do have to distrust the network, which is partly why TLS cert validation now includes a bunch of mitigations around validation from multiple network positions, certificate transparency logs, etc.