What the HTTPS Padlock Means — and What It Doesn't Tell You About a Site
The padlock means your connection is encrypted and the address matches its certificate. It says nothing about who runs the site or whether it's honest — most phishing pages have one too. Check the domain, not the lock.