What the browser padlock actually proves (and what it doesn't)