There are people in the world capable of spoofing SSL one way or another (forged certs, suborned CAs, etc.), though it certainly does raise the bar past the script kiddie level.