Any moderately busy location is already abuzz with dodgy-looking access points. It appears you have to join using an app, presumably that app will check certs against a whitelist.