Additionally, in a very concrete technical sense, "whatever1" must rely on the "chain of reputation" of the https certificate system to have confidence that what they saw is not sora.