Comment by tptacek

Yes! Key continuity is a legitimate identity scheme; the only trick is to implement it scalably, so it actually happens, rather than being a fig leaf (an unworkable variant of key continuity already exists in browsers today).

I think the CA system by itself is inadequate, but unlike unauthenticated TLS, actually does provide some security.