CA-signed: Green lockpad
Self-signed: Yellow lockpad, with question mark superimposed over it
Regular HTTP: Orange, no lockpad (insecure)
Invalid or revoked cert: Red, "stay away" displayed within <blink> tags.
The current UI that most browsers present implies that self-signed certificates are worse ("scarier") than regular HTTP, which is not true.
No lock would suffice for unauthenticated https; those that find the distinction meaningful can investigate the URL. But then you still risk someone bookmarking https://example.com and suffering a downgrade attack from not paying attention to color changes.
The best way forward is probably the creation of a new protocol designator (httpz or something) that is SSL using the SSH key model. But there's no impetus to do this as it's easy enough to pay the CA tax and be on your way with unquestioned "full security".
Then warn the user if the certificate ever changes.