I think the true problem here is associating the word secure with https. It provides a false sense of security when the site served over https is a scam or phishing site, but very few non-technical users understand the difference.