Also it’s no indication that the server itself is secure - if I manage to get access to… say Amazon’s webserver, I could modify it to send all credit card details, usernames, passwords, etc. to me when someone buys something/logs in. The certificate wouldn’t indicate any of that