Why not then just treat the page like it's unencrypted? For the users trained to look for the lock icon, they could look up to the bar and see it marked like a

Why not then just treat the page like it's unencrypted? For the users trained to look for the lock icon, they could look up to the bar and see it marked like an unencrypted page. I've just seen the false sense of security argument backfire. I remember a sysadmin performing a "security upgrade" by converting a self-signed HTTPS server into an unencrypted HTTP server. The users were quite happy that their data was far more secure than it was under the old regime with the scary warnings, despite the fact that they were now being sent completely in the clear.