So you still need to use certificates and be bound to certificate authorities, unless you use a self signed one and trust it?

So basically this is "only" (I mean it's a lot) an alternative way to reach a web site? And does the website still need to have a public IP or is the NWS component "pulling" the connection from the relay somehow? 

 Obviously the browser will complain about the hostname not matching the certificate.  

 It will match the hostname: you visit google.com, you get google's cert, but the traffic goes over nostr (through a socks proxy). 

 I'm refering to the nprofile hostname