The index page should be signed so that trust can be placed in a trusted store.  It should also allow for self-signed certs by their public-key.  This relies on being completed first.