Regarding (B): A few years ago Mozilla did some user research that showed that a significant percentage of people do perceive the passive[1] negative security i

Regarding (B): A few years ago Mozilla did some user research that showed that a significant percentage of people do perceive the passive[1] negative security indicators as indicating a problem with Firefox instead of the web page. Thus, such a change does have to be done carefully. But, I think it is worth trying to find a way to do it that users can understand. [1] Passive indicators are things like the red/broken lock icon. Active indicators the the things that stop the page load, like the "Stop! This is probably a phishing page!" error page. IIRC, users overwhelmingly appreciated the active indicators but tend to misunderstand the passive ones.