Right, sideband, and browsers do it manually for domains they consider "high value".

It has no defense against an ALWAYS mitm

For that matter nothing does, since at some point I downloaded my OS or browser (wherever my CA store is) to begin with.