There was an interesting research a few years ago regarding the SSL icon. Since in many users the idea is actually finely-ingrained that a padlock means security on a website they just made the favicon into a lock. A surprisingly large number of users was fooled by that.

I guess the "padlock means secure" has been superceded a little by "address bar is green somewhere" by now, but the problem remains the same.