I think this is a really good idea. I mean, today to most people the measure of whether or not a site is “secure” is just whether or not the lock icon displays when they’re browsing.

An actual “public shaming” of sites with bad security is probably all that’s effective at this point.