> "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense.

I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model.

Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel.

You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.