So you still need to use certificates and be bound to certificate authorities, unless you use a self signed one and trust it?

So basically this is "only" (I mean it's a lot) an alternative way to reach a web site? And does the website still need to have a public IP or is the NWS component "pulling" the connection from the relay somehow?