Telling the user nothing would not impart a false sense of safety. Heck, why not mark HTTP as insecure, don't mark self-signed HTTPS, and mark CA HTTPS as 'sec

Telling the user nothing would not impart a false sense of safety. Heck, why not mark HTTP as insecure, don't mark self-signed HTTPS, and mark CA HTTPS as 'secure'? Of course, CA HTTPS is not really secure at all, but that's another discussion entirely.