You'll really only get authenticity if you've exchanged certificates in some offline manner first, and eschew the whole CA infrastructure