Originally SSL required identity verification and financial costs were very high.

Fraudulent SSL certs weren't a thing because the barrier to entry way so high and the rewards for spoofing a site were low since e-commerce was insignificant.