To PKI or not to PKI?