The problem is people taking "No lock means it's insecure and untrustworthy" and interpreting it as "No lock makes it untrustworthy, so clearly a lock makes is

The problem is people taking "No lock means it's insecure and untrustworthy" and interpreting it as "No lock makes it untrustworthy, so clearly a lock makes is trustworthy." Not helped by the worrying amount of security "education" that explicitly states that the lock icon is a symbol of trustworthiness. Ultimately this is obvious to technical people: The lock describes the transport layer, and says nothing about the content. But because public technical understanding is so poor, we get the aforementioned misconception. IMO the change is a good one. HTTPS should be seen as the default, with warnings for HTTP. (Though it shouldn't go further - in my opinion HTTP should still be accessible without the kind of security warnings you get for invalid certs etc)