> That's not an acceptable setup. If I am communicating to a service that is TLS protected and I see the little green icon in the top left of the bar, I should be confident that my data that I am communicating to you is not routed over the public internet unprotected!

If you see that little green icon, you can be confident that the server you're communicating with has done the bare minimum to satisfy the browser gods today, so that the https everywhere people will stop yelling. It's never meant anything else. It's best to assume you're talking to a TLS terminator which communicates to the HTTP endpoint via AMPRnet (unencrypted IP via amateur radio).