I get where you're coming from and I want to agree with you but...

While that used to be true, based upon recent history we, unfortunately, can't blindly trust HTTPS to always be "secure" 100% of the time anymore -- whether due to things like Heartbleed, fake certs signed by a root CA, protocol attacks, or some other vulnerability that hasn't even been discovered yet.

Well, what if the host you're connecting to is a Juniper firewall?

Yeah, because illegitimate / spoofed certificates will never happen...

I think we're well on our way to a point where certificates can be mostly trusted. Of course certs can be stolen, but I would bet that "spoofed" certificates will soon be an occurrence of the past.

With certificate transparency, at least we'll know about it - afterwards, at least.

Well, afterwards, if the attack stops (software does not need to stop) in a timeframe short enough for your computer to no clear its history.

Many https sites use RC4, I wouldn't be so sure.

Then use a browser that rejects RC4 (like latest Chrome).

The private key is used to negotiate a session key, which is then used as the symmetric key for RC4 or whatever stream or block cipher you are using. Those session keys are ephemeral and per-session, so leaking them is only a problem for those sessions.

(Also, since it's a stream cipher, it can't use the same key ever again, else you can xor those ciphertexts to get 2 xored plaintexts, which are much easier to crack.)