TOFU, OK, but even with an expired certificate?

[A. E. Spencer-Reed]

> With a self-signed certificate the date is just a setting that the
> certificate issuer can set arbitrarily

Then server owners can set an expiration date in the far future. If
they set a close expiration date, then they are expecting it to
expire.