Hacker News Reader

What would you replace it with?

Signed keys. Here's an example of how to do it from Digital Ocean: https://www.digitalocean.com/community/tutorials/how-to-crea...

Well, feel free to come up with a better solution. 3rd party trust roots are way worse.

The server key can be signed by a trusted authority, no need to trust on first use.