But you don't know that this is the client. If all you're trusting is the cert they already generated, how do you know it's not an attacker?