The point is that we've been able to trust SSL to protect us on open networks. We might not trust the owner of the infrastructure, but SSL meant that we could tell when our request had been tampered with. That's no longer the case.