Yeah, but…
Spoofing limited, except
- not hard to get a certificate to be WWW.CIT1BANK.COM, or www.citybank.com, or www.citibonk.com, or ...
Fine for account transaction with trusted party, not so good for credit cards or other authorization without time limit.