[brcha]

Well, why not then say this is domain registrar's fault, since somebody clearly did allow registration of paypal.com.tk or something similar.

SSL certificate is for secure communication with some website. Whether the website is a malicious one or not has absolutely nothing to do with security of the communication with said site.

I think the problem here is that people believe sites which are SSL enabled are good, and that problem will be fixed when all the web sites become SSL enabled.