The biggest issue with it to me is the "vouch for their security" part, perpetuating the myth that HTTPS means the site is "safe" or that a certificate is a security audit of some kind.

I'm not a fan of promise - it makes it sound like a choice, and not something enforced by the design (assuming it's set up properly, which the CA _can't_ promise).