This is part of my set of gripes, that the chain is buried.  Put it up front.  Even "clueless" users will be somewhat likely to notice when it changes, especially if the popular media nudge them in this direction.<p>Mathematics aside, the basic concepts are not that difficult.  (E.g. chain of trust)  Let the users know what's behind the padlock icon; they'll pick it up.<p>(Oh, and stop making https calls from http pages that ask for security information.  The paradigm of "look for https in the address bar" and "the closed padlock icon" was a good start.  Then everyone went and started breaking it.)