First, browsers added a padlock icon on the left for https:// sites. Then, phishing sites, and even banking websites, started using a padlock for their favicon, and users couldn't tell the difference. So it was abandoned.
Then, the whole background of the URL bar was turned a sort of gold-yellow color when the site was secure. It was like this: http://www.facebookloginhut.com/wp-content/uploads/2010/07/s...
Then that effect was removed, I think it scared some users, or they didn't know to look for it, I don't know.
Now, favicons are never shown in the URL bar so a padlock favicon can no longer mislead. Some browser started hiding "http://", some started coloring "https://". (Now many do both.) The extended-validation green pill thing was added. It's harder than ever to allow a self-signed cert when you're using a service you set up yourself on your LAN.
Apparently there are more changes planned, every year or so. "users" have no chance of keeping this stuff straight, only "experts" like me and you do.
I wouldn't worry as much about how to get people to notice security, browser vendors are on the right track by popping up giant notices for insecure sites and sites with malware.
They just need to extend the "untrusted download" concept from operating systems to email where you could have "untrusted link" warnings in your browser instead. "Are you sure you want to visit paypal.28753272.server? You really shouldn't trust this link..."
Browser developers aren't in a position to retrain users to their preferred ideology. Their job is to find ways to make the web easier to use.
And in fact they have: green URL bars, padlocks etc. – these are UI metaphors that do a much better job than a one-letter change in a cryptic initialism from the 70'ies.
Even holier-than-thou professionals should profit from this: a green URL actually means the connection is protected, whereas it's quite easy to use https without actually using encryption or at least using completely insecure ciphers.