[joshfraser]

My guess is everything is secure, but they are terminating the SSL connection, using a private cert to talk to the clients, and then passing along the information about the original cert. If they didn't do that, they wouldn't be able to optimize much since they couldn't read the content. They would also need a private IP address for every user (impractical), because the HTTP headers get encrypted as well and Amazon wouldn't know where to direct incoming traffic w/o using unique IPs.