Or, you know, the bad guys just *buy* a .secure domain and set it up. Then they just have to wait until the browser makers and company firewalls are cajoled into allowing unrestricted traffic to .secure because of all the legitimate vendors who set themselves up there as well.
Because the bad guys have companies, trade marks, locations, etc. And if their data is protected with SSL and trusted in the browser (for example), then its an investment that pays off.
This is, frankly, wishful thinking. The evil bit does a better job of protecting traffic.