If you're looking for secure payments, you can always direct customers to a .secure payments handler, in much the same way that Paypal does already. The whole domain wouldn't have to operate under a .secure domain, in fact that would be undesirable as it would diminish the importance of it customer's eyes if every major website is on a .secure domain.