I actually work on the Let's Encrypt project (though I'm speaking for myself here), and I have often said when forms of this issue have come up that I'm not sur

I actually work on the Let's Encrypt project (though I'm speaking for myself here), and I have often said when forms of this issue have come up that I'm not sure what the right forms of security indication in browser UI should be. Obviously the Chrome people have been putting a lot of thought and research into this question. It seems like they would probably agree that there are significant challenges here and some fairly bad trade-offs. A simple form of that trade-off is that we don't want people to enter personal information or passwords on non-HTTPS sites, but we don't want them to think that a site being HTTPS means they don't have to care what site it is. We had someone on the Let's Encrypt forums complain that her site got hacked even though she used a Let's Encrypt certificate, which was supposed to make her site "secure". But I'm pretty confident that millions of site visitors experience exactly the same kinds of confusion about the meaning of the certificate, and don't regularly think about all the different dimensions of security here (including the confidentiality of your communications on the wire, the forward secrecy of your communications, the protection of your communications against tampering and content injection, the identity of the site operator, the intentions of the site operator, the data retention practices of the site operator, the data protection practices of the site operator, the jurisdictional exposures of the site operator, whether the site's infrastructure has been compromised, whether it will be compromised in the future, whether third parties can send you data through the site that harms you personally or that harms your devices...).