Some very good points made here. I think you are right that most customers do not understand SSL. But they have been sold the idea of a site being secure once they see the lock icon. Also Certificate Authority's are using every PR tactic they can think of to say sites that are secured with their certificates are secure, from using Extended Validation SSL certificates (which make the address bar go green) to security seals. You may be right about a complete audit not being practical. How company's address this issue should be open for debate.