Hacker News Reader

There's no reason you have to use CAs to authenticate TLS. Plenty of enterprise tools keep whitelists of certificate hashes instead.

There's an RFC on TLS with raw public keys that you should probably check out: http://tools.ietf.org/html/draft-ietf-tls-oob-pubkey-02.

There are several TLS modes that don't use certificates. SRP and PSK are the two that I have some limited experience with. Both require sharing a password or key beforehand through some other medium.

If you're not concerned with man-in-the-middle attacks, then you could also use the ANON modes.

If you control the client software, theres no reason to use a certificate authority instead of making your own CA or just using self-signed certificates.

This maybe:

https://github.com/okTurtles/dnschain