With self signed certificates your ISP can just serve their own self signed certificate, and then inject ads into the recipe blog.