Not even that they're unable, there's a valid certificate & they're deliberately not using it for the site.