Relatively few companies can sign TLS certificates, and you have the security of the domain name as well. In order for an attacker to steal a TLS session they need to compromise both the certificate system and the dns lookup.