You're right -- but do you expect users to View Source to confirm its posting to an SSL url? How else would they be able to tell if a MITM altered the form to post somewhere insecure?