I'm offering my interpretation of the OP's original words defining the terms of the challenge "I won't promise to log in if you can't provide a valid SSL certificate :)".

So my read is that for this particular challenge there's only one "user", the OP. I read it as he's willing to facilitate the attack by using the site from a hostile network but has specifically said he'll check for a valid SSL session.

So by that interpretation, despite how much I think Moxie deserves another $1k for doing great work in general, it seems an SSL strip attack is unlikely to satisfy the offered terms.

Of course I expect an SSL strip attack would be effective against end users generally.