Incidentally, it doesn't have to be evil governments doing this.<p>If your employer uses Watchguard firewalls, they can proxy SSL connections, replace the SSL certificate with one signed by the firewall, and act as a MITM to filter and report the connection contents. If your employer has pushed out certificates by, e.g. active directory and group policies on Windows, then the site will appear padlocked without warnings and you will be none the wiser unless you inspect the certificate. I'm assuming other firewalling products can do similar.