When the 'S' in HTTPS also stands for shady

TL;DR: Users have been conditioned to think HTTPS means "legit site", the sky is falling.