It's trivial to get a cert for HTTPS. That doesn't tell me if the people behind the site are trustworthy, security conscious or going to be around in a year's time

I know that the dotcom doesn't do that either, it's not a rational thing - just a thing