I think that, assuming the proper content of the page is loaded, the communication with Stripe is done over SSL. The problem is that someone could do a MITM and

I think that, assuming the proper content of the page is loaded, the communication with Stripe is done over SSL. The problem is that someone could do a MITM and give you different content that, say, sends your credit card to their server instead. And that would be a much easier MITM than if he were using SSL because they wouldn't even have to provide a fake certificate.