An immediate question that comes to mind is how to be assured that the public key being used is indeed bound to a legitimate entity and not to someone else.