Forging a signature is super hard, man-in-the-middling an HTTPS connection can be very easy (example: a lot of corporate environments do it).