I have been reading a lot about Dapp development, and the gist of it seems to be that you need an ethereum node to connect to with web3.js in the frontend to read/write to the blockchain.
1) You have a choice for a public node or running your own, and the fundamental reasons seems to be a philosophical one which is if you trust your transactions going to the public node; if not then run your own.
2) I read here (What are best practices for serving a DApp over HTTPS, connecting to an Ethereum node using JSON RPC / web3.js, which by default uses HTTP?) that if you want to run your own Ethereum node, that you can't have it run over https, so you have to run it through a proxy. I am basically just fronting the node with an API, what are some other reasons for this?
3) I also understood that your Ethereum node has its own private and public key. You wouldn't have to worry about this if you leave the node locked, but when would I want to unlock and sign a transaction to write to the blockchain? If I do this, I am assuming that I would want to run a separate Ethereum node from the one mentioned in 2) and ensure that only my servers have access to it, is that correct?
4) How is the flow supposed to work here? The user signs a transaction with their private key on the client side, then uses my node from 2) to relay that transaction? Why can't I just do this with a public Ethereum node?
Please correct me if my assumptions are incorrect.