Have to start somewhere. Especially in this age of AI where everything can be faked. Put a "learn more" link that says how they can verify the authenticity. If people aren't interested in learning, that's on them. A padlock doesn't tell you anything. The padlock next the URL just says the connection is encrypted. You used to be able to pay $200 and the cert authority would make you send documents proving you are who you say you are, and it'd show your company name next to the address bar. I went through the process once. It was a good idea IMO, not sure why we got rid of it. Maybe shiesty authorities that weren't doing their due diligence.