Too many “experts” on the TV and radio shows are simply telling people to look for the lock; which, as you point out and us in the game know, it is easy and cheap for bad guys to “get the lock”…. Browsers are removing https now or soon and sites will be expected to be secure by default, but again, that doesn’t stop the bad guys due to how cheap domain names are and how simple it is to get legit certs for it from LE.