Yup, let's not let perfect become the enemy of good.

SSH works basically this way, certs are autogenerated, the client records the key, and lets you know if it changes.

And doesn't everyone recommend SSH over Telnet, despite certs mostly (never?) not being signed?