As I stated in my previous answer to your question, man-in-the-middle attacks (if successful) can own all the data passed back and forth for an encrypted channel.

Certs, both self-signed and issued from a trusted root, can be faked, so don't be lulled into a false sense of security if you issue one to your users from a trusted root.  The only issue I have to overcome with one issued by a trusted root, is ***getting your user to accept mine when I'm trying to arp-poison their computer***.  If you think about most end users, how easy would this be?

Can you see the problems now?

Once the end-user accepts MY cert, I own the connection from that point forward and all data passes through my machine.