Yeah. That was also roughly the conclusion of my masters thesis: https://scholarsarchive.byu.edu/etd/7403/ https://scholarsarchive.byu.edu/etd/7403/ ("After HTT

Yeah. That was also roughly the conclusion of my masters thesis: https://scholarsarchive.byu.edu/etd/7403/ https://scholarsarchive.byu.edu/etd/7403/ ("After HTTPS: Indicating Risk Instead of Security") -- we examined the flaws of current browser warnings and security messages and one of the big ones is that attackers can use those UIs against you. (Hence our proposed solutions all involved UI above the LoD.)