What I see as a problem is that it legitimizes the idea of a message in a browser telling you that your computer is infected with malware.

A rule of thumb I've given to the confused class of users is that only antivirus programs or Windows will tell you something like this, and that if a browser window pops up and claims to be running a scan it's lying. Now Google is screwing that all up.

Is that an argument for doing googling over https? Or maybe trying to get first usage of the new secured DNS (I apologize I am off-news and don't know how that will be working...)?

Not really. The assumption here is that the attacker installed malware on the target computer to get their traffic redirected to the proxy. Once the computer is compromised there are any number of ways to nullify any signing benefits from ssl or dnssec.

You mean DNSSEC? That would protect against cache poisoning but not certain it applies here.

Considering I got Google+ phishing attempts 3 days after creating an account, I'd bet the same.