This is even worse on mobile apps as they typically just show that page in a web view without the ability to even see the URL/cert