a scam website *can* have a green-company-name type SSL certificate; that and the lock in your browser don’t mean “you should trust this website,” it really *only* means your communications with it are private
and this feels like a microcosm of the broader issues
sorry, this got kind of rambly, but my vague point is the internet is as powerful as it is dangerous and I don’t think people quite understand that