I was oversimplifying my limited understanding. What I belive should be true is that you are connecting to a server that: 1. managed to obtain a valid certific

I was oversimplifying my limited understanding. What I belive should be true is that you are connecting to a server that: 1. managed to obtain a valid certificate from some recognized autority 2. managed to steal a valid certificate for the domain in question from another server 3. managed to convince enough DNS resolvers to point to their IP for a given domain (so to get your traffic and/or pass LE challenges) and/or other conditions. From an operational perspective it says very little, especially considering the third case where any public wifi network has in most cases total initial control over your DNS traffic.