Irony of ironies, I actually got a lecture from a PS3 engineer about how insecure SSL is with only a server-side certificate, along with a demonstration of sniffing the traffic via Charles. I had to point out that A) you have to accept Charles' root cert and B) distributing client certificates for a consumer web app is a non-starter.